Live data from Hacker News

Don't use autofill in your browser

yoast.com

21–30 of 74 posts

Re: Don't use autofill in your browser

#21

Web devs can recommend input fields not use autocomplete: http://www.w3schools.com/tags/att_input_autocomplete.asp It's considered good practice to use it on login fields, but otherwise depends on whether you think security or user preference should take priority.

Why is it good practice to use it on login fields? That just means your users will use weaker (easier to remember) passwords on your site instead of using random, unique ones stored in a password manager.

Re: Don't use autofill in your browser

#28

Web devs can recommend input fields not use autocomplete: http://www.w3schools.com/tags/att_input_autocomplete.asp It's considered good practice to use it on login fields, but otherwise depends on whether you think security or user preference should take priority.

An attacker that can make use of an auto-completing password field has got enough access to mean that the game is over anyway - they can get that password from a variety of other sources on the machine.

Turning off autocomplete on login fields doesn't make that form more secure, and it does annoy users.

As kalleboo says, it probably reduces security as your users change to easy to type passwords, or keep needing password resets.

Re: Don't use autofill in your browser

#29

Safari tells you what is actually going to autocomplete, so you could easily catch stuff that should not be sent...

This is true, and actually a pretty smart feature, but you have to take the time to double-check (which I suspect most users won't).

Usually I agree that people will blindly click through, but I don't see people clicking through this[1]. Especially if Safari said it would auto-fill your credit card number and you weren't buying anything?

[1] https://www.evernote.com/shard/s356/sh/dcf7867e-eb16-4e0e-83...

Post reply on HN