Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The war against autocomplete=off (2013)

blog.0xbadc0de.be

Post reply on HN
Print view View original

21–30 of 78 posts

Re: The war against autocomplete=off (2013)

#21

Post by claudius »

michaelbehan wrote: post #13

This article uses "password managers" ambiguously. In my opinion, a browser is a terrible password manager because of what is stated in the "pros" section of the article. My advice aligns with others who have replied here - get a real password manager such as 1password and allow autocomplete="off" to do what it is supposed to do.

Sorry, but which of the two points in the ‘pro’ section (storing truly sensitive visible information and hacking of client-site databases) makes a browser less capable of acting as a password manager than a ‘real’ password manager?

Or maybe you could rephrase why you think browsers are terrible password managers? I’m quite fond of Opera’s Wand.

Re: The war against autocomplete=off (2013)

#22

Post by tptacek »

spindritf wrote: post #15
205guy wrote: post #14

The original article fails to take into account the larger population. The basic password managers in browsers are huge security holes. The one in FF does not use a master password by default, so anyone could look at an unattended computer and see all stored passwords with a few clicks. The article mentions an old JavaScript attack on the passwords as well (but then dismisses the threat, since that one hole was patch…

Compared to weak passwords, phishing and a myriad other threats, how likely is that someone will walk up to my computer and copy a password? How likely are they to have a true criminal intent rather than a prank on their mind? And when your machine is compromised or otherwise controlled by an untrustworthy third party, you lost anyway.

Nobody is arguing that autocomplete is a threat on par with phishing.

Re: The war against autocomplete=off (2013)

#23

Post by odin1415 »

penguindev wrote: post #17

> Please note that if you combine this policy and at the same time disable copy and paste into the password fields (I look at you, Blizzard!), I hate you. oh man. disabling paste is the worst, because it breaks keypassx. (Apple did this last I checked!) turbotax did that as well last year, this year they made it sane again. Luckily there's a firefox about:config setting you can do to not let websites hijack / block y…

If you hit ctrl+v in keepassx it should "autotype" your password for you, bypassing any paste blocking.

Re: The war against autocomplete=off (2013)

#24

Post by gdulli »

I used to use Chrome as my second browser, where I'd keep my work gmail account up.

Recently it started to no longer save my password, even with an autocomplete=on plugin installed that works on other sites. That was my catalyst for uninstalling Chrome altogether and moving to Firefox for everything.

Re: The war against autocomplete=off (2013)

#25

Post by smackfu »

badman_ting wrote: post #20

Right, this isn't what autocomplete=off is for. It's for fields where correcting the user's input to dictionary words is of negative utility, for example, typing stock tickers should not correct "aapl" to "apple".

Isn't that the "autocorrect" option?

Re: The war against autocomplete=off (2013)

#27

Post by badman_ting »

smackfu wrote: post #25
badman_ting wrote: post #20

Right, this isn't what autocomplete=off is for. It's for fields where correcting the user's input to dictionary words is of negative utility, for example, typing stock tickers should not correct "aapl" to "apple".

Isn't that the "autocorrect" option?

Duhh, right you are. I keep conflating the two.

Re: The war against autocomplete=off (2013)

#28

Post by joshuahedlund »

> Tell me how I am supposed to fulfill these requirements if I need 20 websites daily to do my work ?

One solution to this problem (or at least one way to severely mitigate it) is to use a base word that you tweak with a simple algorithm based on the first letter, last letter, number of letters in the domain, etc. Of course some websites have mutually exclusive requirements, so this doesn't work for all sites, but I've been doing this for so many years now that while I have muscle memory for frequently used sites, I can go to a site I haven't been to in years and have no memory of the actual characters in the password, but I apply my algorithm and voila, it works!

Re: The war against autocomplete=off (2013)

#29

Post by dasil003 »

claudius wrote: post #21
michaelbehan wrote: post #13

This article uses "password managers" ambiguously. In my opinion, a browser is a terrible password manager because of what is stated in the "pros" section of the article. My advice aligns with others who have replied here - get a real password manager such as 1password and allow autocomplete="off" to do what it is supposed to do.

Sorry, but which of the two points in the ‘pro’ section (storing truly sensitive visible information and hacking of client-site databases) makes a browser less capable of acting as a password manager than a ‘real’ password manager? Or maybe you could rephrase why you think browsers are terrible password managers? I’m quite fond of Opera’s Wand.

I'm going to go out on a limb and suggest just because 1password is really really good. So good that I don't even want to try a browser's password manager (especially since I want access to my passwords on multiple browsers and my phone/tablet as well). I'm sure browser password managers have made leaps and bounds, but so as 1password and it's amazing.

Re: The war against autocomplete=off (2013)

#30

Post by rz2k »

tptacek wrote: post #22
spindritf wrote: post #15

Earlier quoted context omitted.

Compared to weak passwords, phishing and a myriad other threats, how likely is that someone will walk up to my computer and copy a password? How likely are they to have a true criminal intent rather than a prank on their mind? And when your machine is compromised or otherwise controlled by an untrustworthy third party, you lost anyway.

Nobody is arguing that autocomplete is a threat on par with phishing.

I think the argument is that you are less likely to use the same password on every site and service, or easily guessed passwords, if you are allowed to use a password manager.

In other words, in practice there is an actual tradeoff between the two.

Post reply on HN