The Password Alert extension is designed to warn users when they're about to enter their Google passwords into a fraudulent site. The extension is meant as a defense against phishing attacks, which remain a serious threat to consumers despite more than a decade of research and warnings about the way the attacks work.
However, Moore then began looking more closely at the code for the extension, and Chrome itself, and discovered another way to get around the extension. He said this one likely will be more difficult to repair.
"The second exploit will prove quite difficult (if not near impossible) to resolve, as it leverages a race condition in Chrome which I doubt any single extension can remedy. The extension works by detecting each key press and comparing it against a stored, hashed version. When you've entered the correct password, Password Alert throws a warning advising the user to change their password," Moore said.
Dorff's next monthly bill was for $15,687.64, bringing his total outstanding debt to AT&T, including late fees, to $24,298.93. If he didn't pay by May 8, AT&T warned, his bill would rise to at least $24,786.16. Droff then called David Lazarus, business columnist for the LA Times, who got in touch with AT&T, who wasted little time in deciding it would waive the more than $24,000 in charges.
AT&T spokeshole Georgia Taylor claims Dorff's modem somehow had started dialing a long-distance number when it accessed AOL, and the per-minute charges went into orbit as he stayed connected for hours.
AT&T declined to answer the LA Times questions about why AT&T didn't spot the problem itself and proactively take steps to fix things? AT&T also declined to elaborate on whether AT&T's billing system is capable of spotting unusual charges and, if so, why it doesn't routinely do so.