Top all-time · #7279
Marek Tóth
Personal blog · marektoth.com/blogsecurityprogramming
Marek Tóth's personal blog at marektoth.com covers security and programming. Since 2021, 10 different Hacker News readers have linked it 10 times, most often “DOM-Based Extension Clickjacking: Your Password Manager Data at Risk”. No feed was found, so read it on the site itself.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link Marek Tóth's posts on DOM-based clickjacking, which can make password manager autofill send credentials to an attacker. The posts come up in threads on password manager and npm compromise security.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Security Researcher | Ethical Hacker | Web Application Security
Most-linked posts?
- DOM-Based Extension Clickjacking: Your Password Manager Data at Risk7 people · 7 mentions · first linked 2025-08-20
- Autofill in password managers can allow login credentials to be stolen2 people · 2 mentions · first linked 2021-07-26
What Hacker News says?
Are you refering to this one https://marektoth.com/blog/dom-based-extension-clickjacking ? This doesn't seem to be "passwords on random pages", only "Personal Data + Credit Card,", passwords are domain-specific unless the website is hacked itself. > The attacker can only steal credentials for the vulnerable domain.
Comment linking /blog/dom-based-extension-clickjacking
on “DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware”Submitted Autofill in password managers can allow login credentials to be stolen as a story · 226 points
HN discussionWell it still recognises to autofill in the password on a different subdomain as shown in the PoC by default, which is not good at all. To Downvoters: So in the PoC [0] with the default settings the author is completely wrong about their findings? even if you 'manually' autofill in the fields? So you are saying that the password DOESN'T get extracted out of Bitwarden from a different subdomain than where the login d…
Comment linking /blog/password-managers-autofill/
on “Autofill in password managers can allow login credentials to be stolen”Submitted DOM-Based Extension Clickjacking: Your Password Manager Data at Risk as a story · 4 points
HN discussionOriginal article: https://marektoth.com/blog/dom-based-extension-clickjacking/
Comment linking /blog/dom-based-extension-clickjacking/
on “Password Managers Vulnerable to Data Theft via Clickjacking”Submitted DOM-Based Extension Clickjacking as a story · 4 points
HN discussionAutofill can be an attack vector. Lookup Dom-based clickjacking. It will "autofill" the field but on submission it sends the data to an attacker. "The new technique detailed by Tóth essentially involves using a malicious script to manipulate UI elements in a web page that browser extensions inject into the DOM -- for example, auto-fill prompts, by making them invisible by setting their opacity to zero. The research…
Comment linking /blog/dom-based-extension-clickjacking/
on “On Getting Hacked”Submitted DOM-Based Extension Clickjacking: Your Password Manager Data at Risk as a story · 4 points
HN discussionSubmitted DOM-Based Extension Clickjacking: Your Password Manager Data at Risk as a story · 2 points
HN discussionSubmitted DOM-Based Extension Clickjacking: Your Password Manager Data at Risk as a story · 2 points
HN discussion
