I love the edited title of this post. It reflects accurately the reality of the situation. Hey, battre, hi there! You are famous now!
Issue 914451: Autofill does not respect autocomplete="off"
11–20 of 383 posts
Re: Issue 914451: Autofill does not respect autocomplete="off"
#12There was a time when IE was the dominant browser, and happily did whatever they wanted to. That was arguably better, because at least they acted predictably. Chrome has been continually altering how autocomplete is handled in the last 5 or 6 major releases
They acted predictably by never updating IE and letting it stagnate. Hard to see how that is better in any meaningful way.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#13Earlier quoted context omitted.
> It seems to reduce the potential for security leaks Misguided views like this are exactly how. Turning off autocomplete doesn't improve any sort of security, since the site already needs to trust the browser. It serves no purpose other than to frustrate the user, and might even reduce security if it prevents the user from easily making use of a password manager.
plenty of stuff (like credit card info for instance) should absolutely never be auto-completed. The browser storing that sorta stuff to disk is stupid and completely avoidable. Already caught chrome doing this to my Social Security Number before i disabled the functionality entirely. The idea of Chrome automatically auto filling any form it sees labeled "SSN" on any site dosen't inspire confidence.
One CRM webapp I worked on took our frontenders several attempts at different hacks to get Chrome to stop treating the SSN-equiv field as a credit card autofill.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#14Earlier quoted context omitted.
> It seems to reduce the potential for security leaks Misguided views like this are exactly how. Turning off autocomplete doesn't improve any sort of security, since the site already needs to trust the browser. It serves no purpose other than to frustrate the user, and might even reduce security if it prevents the user from easily making use of a password manager.
Agreed on password fields, however if you have a webapp crm it causes so many problems. And also giving a solution of "hey just put something that we don't understand in the autocomplete so we won't try to autocomplete it" is really not a solution at all. Imagine if instead of autocomplete it was something like ignoring font sizes/color because they detected that engagement was low when font size was whatever so they…
You just described reader mode!
Re: Issue 914451: Autofill does not respect autocomplete="off"
#15Explanation from the 'rogue Chromium dev' is linked to in comment 19 of this bug: https://bugs.chromium.org/p/chromium/issues/detail?id=914451... https://bugs.chromium.org/p/chromium/issues/detail?id=468153...
...which really makes it worse:
1. Our programming language has an attribute called "autocomplete" with two possible values: "on" and "off"
2. We will now (without consultation or announcement) simply start ignoring one of those values when you specify it. (and certainly not document the new behaviour!)
3. Here, I made you a convoluted (and undocumented!) workaround for getting the original behaviour of the attribute back.
I'm not sure which horse these FAANG kids who excel at programming challenges rode in on, but this attitude is RIFE in their product SDK's and API's.
Dijkstra must be spinning in his grave.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#16I would love it if someone explained how 'autocomplete=off' can lead to abuse of some kind. It seems to reduce the potential for security leaks.
It causes spec-compliant password managers to not work. Unfortunately, disabling autocomplete for password fields is an often used form of security-theatre
Combine that with sites attempting to block pasting in a "complex, secure" password and I start to see Google's point here, bad as I don't want to. How "auth" is handled, at almost every layer, seems about as badly broken as "security" in the U.S. banking system.
Fortunately, Firefox gives me dom.event.clipboardevents.enabled so I at least need not worry about my workaround being broken.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#17There was a time when IE was the dominant browser, and happily did whatever they wanted to. That was arguably better, because at least they acted predictably. Chrome has been continually altering how autocomplete is handled in the last 5 or 6 major releases
They acted predictably by never updating IE and letting it stagnate. Hard to see how that is better in any meaningful way.
You still had a choice, nowadays being a Web Developer is almost a synonym for Chrome Developer and it was the IE hatting crowd that made it happen.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#18A few years ago, I left a $1000 tip at the restaurant up the street because Chrome filled out the tip field with my zip code (which thankfully merely defaulted to max $1000 instead). The tip field was off-screen, and the ordering software didn't have a confirmation screen, just a "we just charged your card $X amount" screen, which made my eyes boggle.
EDIT: Looking at the original March 17th, 2015 bug, it would have been at exactly around that time...In fact, checking my emails, this happened on March 18th, 2015. I had ordered from them several times before this with no problems (they used "chownow.com" for their ordering backend).
Re: Issue 914451: Autofill does not respect autocomplete="off"
#19I would love it if someone explained how 'autocomplete=off' can lead to abuse of some kind. It seems to reduce the potential for security leaks.
It causes spec-compliant password managers to not work. Unfortunately, disabling autocomplete for password fields is an often used form of security-theatre
Ok, but how is that abuse? And if autocomplete=off is part of the html standard, how are the password managers spec compliant if they can't deal with it? Are people doing this just to annoy users who prefer password managers?
Re: Issue 914451: Autofill does not respect autocomplete="off"
#20The way I see it, autofill off should mean off and if I click the icon in the address bar to bring up, well, let’s call it “quick access to per-site settings” then maybe I could override it for a specific page load or site, like you can Flash, etc.? This per-site configuration is starting to become “normal” given iOS 13 does the same in Safari for permissions, content blocking, automatic reader mode, etc. It would make sense that the default is “follow the HTML5 spec” but you could put a notice in the address bar if you really felt otherwise...?
Safari does a much better job by only filling visible form fields, I think (though it too has a tendency to put my address both in Line 1 and Line 3, which is annoying...).