
Journal Journal: Passwordjacking on SNS may leak private information
Any login forms, that can be loaded in malformed IFRAME, may lead users into logging in to the website unintentionally if the targeted user had saved password in browser.
It is a sort of clickjacking. If SNS have this vulnerability, this attack may leak users information like realtime location even if the user had logged out consciously. The secure methods to prevent this attack is already known as prevention of clickjacking or CSRF. But these methods have not been applied carefully on the pages that can be loaded without login, I think.
I found only one SNS that accept this attack now. Though there may be more insecure SNS.