Autofill features in browsers and password managers are incredibly convenient—but they can also introduce risks if not configured properly. Attackers can exploit autofill by tricking your browser into filling in credentials on malicious sites.
What Is Autofill?
Autofill is a browser feature that automatically fills in form fields with previously saved information like usernames, passwords, addresses, and credit card details, saving you from typing the same information repeatedly.
For instance, hidden login forms or fake fields embedded in webpages can capture your information without your knowledge. Autofill tools may also populate sensitive data like addresses or credit card numbers on sites you didn't intend.
The Hidden Dangers of Autofill
1. Form Field Confusion
Browsers often can't tell the difference between legitimate form fields and malicious ones. When you visit a website with autofill enabled, your browser might fill hidden fields designed to steal your information.
2. Invisible Form Fields
Attackers can create invisible form fields that your browser will still populate. You might only see one field on screen, but behind the scenes, your browser could be filling in multiple fields with sensitive information.
Attack Example: The Hidden Field Attack
Imagine visiting what looks like a simple newsletter subscription form asking only for your email. Behind the scenes, the page could contain hidden fields for name, address, phone number, and even credit card details. When you click in the email field, your browser might autofill all these hidden fields, giving the attacker information you never intended to share.
3. Cross-Site Autofill
Some browsers might autofill credentials from one site onto a similar-looking but completely different site. This makes phishing attacks much more dangerous—if you're tricked into visiting a fake version of your bank's website, your browser might helpfully fill in your banking credentials.
4. Over-Eager Form Filling
Even when you just click on a single field, your browser might fill in multiple related fields. For example, clicking on an address field might trigger autofill to populate your full name, address, phone number, and email.
How to Use Autofill Safely
Despite these risks, you don't have to completely abandon the convenience of autofill. Here's how to use it safely:
Use a Dedicated Password Manager
A good password manager will only fill in credentials on the specific sites they belong to, reducing the risk of cross-site attacks. It will also typically ask for confirmation before filling in sensitive information.
Recommended options include:
- Bitwarden (open source and free)
- 1Password
- KeePassXC (local storage only)
Adjust Browser Autofill Settings
Most browsers let you control exactly what gets auto-filled. Consider these settings:
In Chrome:
- Go to Settings → Autofill
- Consider disabling "Addresses and more" and "Payment methods"
- For passwords, click on "Passwords" and toggle "Auto Sign-in" off
In Firefox:
- Go to Options → Privacy & Security
- Under "Forms and Autofill," uncheck "Autofill addresses"
- Under "Logins and Passwords," consider unchecking "Autofill logins and passwords"
In Safari:
- Go to Preferences → AutoFill
- Consider unchecking "Credit cards" and "Contact info"
- For passwords, go to Passwords and disable "AutoFill user names and passwords"
Segregate Your Information
Consider using different autofill profiles for different purposes:
- Create one profile for financial sites
- Use another profile for shopping
- Maintain a separate profile for general browsing
Manually Approve Autofill
Configure your password manager to ask for confirmation before filling in credentials. This small extra step provides a significant security boost by ensuring you're on the correct site before your credentials are entered.
Disable Autofill on Public or Shared Computers
Never enable autofill on computers you don't personally own. If you must use a public computer, browse in incognito/private mode and manually enter any required information.
When to Avoid Autofill Completely
In some scenarios, it's best to disable autofill entirely:
- Financial websites - Consider manually entering your banking credentials every time
- Tax preparation sites - These contain your most sensitive financial information
- Medical portals - Health information is highly sensitive and protected by law
- Government sites - Sites handling your legal identity information should be treated with extra caution
How to Spot Potential Autofill Attacks
- Watch for sites asking for minimal information but showing many form fields briefly
- Be cautious of forms that "jump" or refresh when you click on them
- Check the URL carefully before entering or autofilling any information
- Be suspicious if a site asks for more information than seems necessary
Password Managers vs. Browser Autofill
While browsers offer built-in password management, dedicated password managers typically offer superior security features:
- Better form analysis - They're more careful about where they fill in data
- Domain matching - They strictly validate website URLs before filling credentials
- Explicit user actions - Many require you to click a button or use a keyboard shortcut to fill forms
- Security auditing - They often include tools to check for weak or reused passwords
If you choose to use a browser's built-in password manager, make sure you're using the latest version of your browser and regularly review your saved passwords.
Mobile Autofill Considerations
Mobile browsers and apps have their own autofill mechanisms that carry similar risks. On mobile:
- Use your phone's built-in password manager (like iCloud Keychain or Google Password Manager) or a trusted third-party app
- Enable biometric authentication (fingerprint or face recognition) before autofill occurs
- Be particularly cautious with SMS autofill, which can sometimes populate the wrong fields
The Balance: Convenience vs. Security
The key to using autofill safely is finding the right balance between convenience and security. For most people, this means:
- Using a dedicated password manager for credentials
- Being selective about what other information (addresses, payment details) you allow to be auto-filled
- Manually entering information for your most sensitive accounts
- Regularly reviewing and cleaning up your saved autofill data
The Takeaway
Autofill isn't inherently bad, but like any tool, it needs to be used wisely. Proper settings and situational awareness go a long way in keeping your personal information secure while still benefiting from the convenience that autofill provides.
By understanding the risks and implementing the safeguards described above, you can continue to save time with autofill while maintaining strong security practices.
Remember: The few seconds saved by autofill aren't worth compromising your financial or personal information. When in doubt, type it out!