61–70 of 74 posts
I dont see the problem all that was filled in was my name. The other fields were left blank. Even when I reentered it after the other fields popped up.
Only occurred in Safari for me, not in Chrome or FireFox. Also I was a little confused by autocomplete, I thought he meant for the address bar.
This seems like an easy fix for the layout engines. Only include a field on autofill if it's currently visible on screen. One might even classify this as a bug.
"Visible on screen" unfortunately is a hard thing to determine. You can easily imagine a textbox with white text on a white background, or a very small textbox, or a textbox that briefly pops up whenever you type a keystroke or click the mouse, or... Browsers really need to support some mechanism where the user can determine precisely what information will be filled prior to it being handed over to the website. This…
----------------------------------------------------
| This webpage is asking for information that your |
| browser can automatically fill in for you. Check |
| the box next to each item you'd like to include. |
| |
| [x] Email address - bob@example.com |
| [ ] Name - Bob Jones |
| [ ] Address - 123 Sample Street |
| |
| [Autofill] [No thanks] |
----------------------------------------------------When your girlfriend borrows your computer and the browser sends her to porn sites.
This seems like an easy fix for the layout engines. Only include a field on autofill if it's currently visible on screen. One might even classify this as a bug.
I suspect this would be very difficult to implement robustly. There are just too many ways to hide something: color it white, overlay another element on top, use a weird font that causes it to look like something else, ...
Doesn't seem to be an issue in Firefox, as far as I can tell. Certainly didn't fill any other fields for me.
Works in Chrome if I use certain autofill sets (ended up testing with email address rather than name and it worked)
Earlier quoted context omitted.
An attacker that can make use of an auto-completing password field has got enough access to mean that the game is over anyway - they can get that password from a variety of other sources on the machine. Turning off autocomplete on login fields doesn't make that form more secure, and it does annoy users. As kalleboo says, it probably reduces security as your users change to easy to type passwords, or keep needing pass…
Sorry, there's a bit of misunderstanding here; I should have made it clearer. Password type fields shouldn't autocomplete on browsers anyway. The "good practice" I meant is for devs to set autocomplete off for the username field - to prevent the login username or email address popping up (especially if the site is accessed on public or shared computers).
> especially if the site is accessed on public or shared computers
People setting up those computers need to learn how to provide clean sessions for their users, rather than relying on every single website in the world doing weird things in forms.