As an example, should a company have a login page at and allow users to serve content under these users are able to steal credentials from the Bitwarden extensions,” Flashpoint explained. “Some content hosting providers allow hosting arbitrary content under a subdomain of their official domain, which also serves their login page. This means that if you stumble upon a phishing page, with a subdomain that matches the base domain you’ve saved your password for, Bitwarden might automatically provide it to the hacker. Bitwarden’s autofill on page load also works on subdomains of the domain you’re trying to access, as long as the login matches. There’s another way hackers could steal your passwords, though. In its report, Flashpoint said: “While the embedded iframe does not have access to any content in the parent page, it can wait for input to the login form and forward the entered credentials to a remote server without further user interaction.” This is because autofill on page load automatically fills out your login and password both on the page you’re on and within the iframe - and that exposes you to certain risks. How Microsoft 365 Copilot unleashes ChatGPT from its restraintsĪccording to Flashpoint, using Bitwarden with autofill enabled on a page that contains iframes could result in password theft. GPT-4 has come to LinkedIn, because of course it has

NordPass adds passkey support to banish your weak passwords

Bitwarden android app autofill