Friday, September 21, 2007

Updated HSBC Password Easyfier

I figured out that the HSBC security key mechanism is much simpler than before. The security key input is a regular password input, the protection against keyboard entry is simply a function that fires on key down and cancels your input. This is very easily defeated by simple reassigning the event handler to a dummy function!

See the new user script: http://userscripts.org/scripts/show/9832

// ==UserScript==
// @name HSBC Password Easyfier
// @namespace hsbc
// @description Lets you input your Security Key with your keyboard
// @include https://www.us.hsbc.com/*
// ==/UserScript==

window.addEventListener('load', init, false);
function init() {
var oldPassInput = document.getElementById("password");
if(undefined != oldPassInput){
oldPassInput.setAttribute("onkeydown", function(e){})
}
}