Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't use autofill in your browser

yoast.com

Post reply on HN
Print view View original

51–60 of 74 posts

Re: Don't use autofill in your browser

#51

Post by bad_user »

michaelmartin wrote: post #3

I just don't store credit card details in my browser. Auto-complete for emails is extremely handy and I use that all the time, but does purchasing things online really need to be any easier? I don't mind reaching for my wallet there; it forces you to make a conscious decision to spend the money, which is at least slightly better than a 1-click impulse.

True and it takes what? 1 minute of typing? Do we really need to go faster than that? Of course, companies are all in favour, but it's not in our interest.

Re: Don't use autofill in your browser

#53

Post by bad_user »

praseodym wrote: post #46

Firefox and the Mozilla Suite have had a very similar problem since at least 2005: it autofilled usernames and passwords, which creates a problem with XSS or user-generated content on the same domain. The bug was marked WONTFIX: https://bugzilla.mozilla.org/show_bug.cgi?id=280469

Strange, but for me Firefox does not auto-fill passwords, unless you provide a username (and of course, you opted into auto-filling). What did it do, as I don't understand? Did it automatically auto-fill password fields that happened to get loaded on the page?

Re: Don't use autofill in your browser

#54

Post by [deleted] »

Tobu wrote: post #40
eli wrote: post #38

Earlier quoted context omitted.

The fields in this demo are being echoed back from the server, so if you see values in them then it is indeed proof they are being leaked.

The fields appear immediately, the demo actually does this: $("#mine").submit( function() { $("#hide").css("height","auto");

[deleted]

Re: Don't use autofill in your browser

#55

Post by praseodym »

bad_user wrote: post #53
praseodym wrote: post #46

Firefox and the Mozilla Suite have had a very similar problem since at least 2005: it autofilled usernames and passwords, which creates a problem with XSS or user-generated content on the same domain. The bug was marked WONTFIX: https://bugzilla.mozilla.org/show_bug.cgi?id=280469

Strange, but for me Firefox does not auto-fill passwords, unless you provide a username (and of course, you opted into auto-filling). What did it do, as I don't understand? Did it automatically auto-fill password fields that happened to get loaded on the page?

It indeed autofilled password fields on the page. Haven't re-tested it, but I think most browsers still show the same behaviour.

Re: Don't use autofill in your browser

#56

Post by roc »

Sephiroth87 wrote: post #9

Safari tells you what is actually going to autocomplete, so you could easily catch stuff that should not be sent...

Isn't that like claiming individual permissions pop-ups are working just fine on mobile devices, because people are carefully and individually considering whether each given app needs each requested permission?

If some autofill feature starts training users to click "Ok, Ok, Ok, Ok, whatever, just Ok!" any time they sign up for some account or site feature, how long until masses are unwittingly sending along way more data than any sober assessment suggests they ought to and we're shrugging our shoulders and saying "well, the site asked..."

Re: Don't use autofill in your browser

#58

Post by elwell »

Tobu wrote: post #31
AndrewDucker wrote: post #4

Doesn't seem to be an issue in Firefox, as far as I can tell. Certainly didn't fill any other fields for me.

Even if it showed you the fields, it wouldn't be conclusive proof of a privacy leak. Firefox shows links visited without exposing that property outside of render context: https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...

I think the concern is that you might submit a form to a server without knowing that you're sending all that data (just some of it).

Re: Don't use autofill in your browser

#59

Post by elwell »

michaelmartin wrote: post #3

I just don't store credit card details in my browser. Auto-complete for emails is extremely handy and I use that all the time, but does purchasing things online really need to be any easier? I don't mind reaching for my wallet there; it forces you to make a conscious decision to spend the money, which is at least slightly better than a 1-click impulse.

Credit card details are not the main concern here (because they are separated on Chrome), but you could send your address and phone number to a server without expecting to send more than your name or email address.

Re: Don't use autofill in your browser

#60

Post by elwell »

Ellipsis753 wrote: post #17

Seems to work correctly (only name is submitted as one would expect) on Firefox 24.0 and Chromium 30.0. Edit: This is on Gentoo Linux.

You have to have an autofill set up with more information than just your name. You can tell if you have this set up because when the autofill choices show they will have your address etc in gray next to the choices you are auto-completing.
Post reply on HN