Unfamiliar email in form autocomplete- how freaked out should I be?

January 5, 2016 6:44 PM

I'm worried I've done something deeply stupid and potentially made my PC vulnerable. Full details below the fold.

Okay, so:
My usual browser is Firefox, but I have a huge saved session with tons of tabs that takes a long time to load. Occasionally I'll pop up MS Edge, even though it is objectively garbage, to look up a single thing.

In this case I went to itch.io to download their client so I could consolidate some indie games and comics under one desktop launcher. Edge warned me the installer was "associated with suspicious activity" and forbade me from running it, but independent scans with MS Defender and Malwarebytes showed nothing, so I went ahead with it- figured it was probably a security certificate hiccup or something benign.

I haven't used itch in a while, so I opened up their "forgot password" page, also in Edge. I clicked on the box, and in addition to what I assume is probably my screen name, and my email address (which is the same name @gmail), there was a completely unfamiliar address.

I searched my contacts to see if I'd any contact with someone of that name, then a general web search which led me to a pastebin file that appears to be a listing of webmail accounts and passwords. Mine isn't on the list, but seriously, what the hell is going on?

posted by Merzbau to Computers & Internet (3 answers total)

Response by poster: I'm running a complete MalwareBytes scan now (nothing found so far) and finally got paranoid enough to turn on Gmail's 2-factor authentication, but still wondering wtf happened to get a stranger's email address in what I assume is data stored locally on my computer.
posted by Merzbau at 7:13 PM on January 5, 2016

Response by poster: Something else occurs to me: it's hard to phrase this question in a way that will return any useful search results, but I did find a couple of threads of people complaining about finding strangers' information in autocomplete forms in Chrome. Which made me realize that Windows 10 defaults to a Microsoft cloud account instead of a local user account; I'll try and escalate this to MS customer service but the upshot is I'm a little less worried about my actual PC being compromised...
posted by Merzbau at 7:41 PM on January 5, 2016

Here is my wild-ass guess, as a non-Edge user: I think what you're seeing here is something wonky going on with Edge's saved form data. You say you saw the erroneous info in a drop-down after clicking the input box, yes? Like in the image in this forum thread? This is Edge's form autocomplete at work. Where Edge is scraping that info from is a question I can't begin to answer though.
posted by trunk muffins at 7:47 PM on January 5, 2016