Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Issue 914451: Autofill does not respect autocomplete="off"

bugs.chromium.org

Post reply on HN
Print view View original

101–110 of 383 posts

Re: Issue 914451: Autofill does not respect autocomplete="off"

#101

Post by ko27 »

ss3000 wrote: post #87

Setting aside the merits/lack-thereof of this particular decision, Chromium ignoring established web standards like this is especially dangerous as we're trending towards a world where 1) Chromium itself powers the most popular browser in the world by an increasingly unhealthy margin, and 2) even competing browsers are increasingly becoming skins on top of Chromium. We are becoming more and more reliant on the develo…

Strictly speaking, Chrome is not ignoring a web standard, since the standard does not require this behavior (no "MUST" keyword).

Re: Issue 914451: Autofill does not respect autocomplete="off"

#103

Post by donatj »

Thorrez wrote: post #75
donatj wrote: post #64

Earlier quoted context omitted.

lol, years and years ago (like 2005) as an attempt at stopping XSS and CSRF attacks and bots I came up with a system that named all the inputs a salted MD5 of the intended name with the salt randomly generated then stored in the users server side session. It’s still a reasonably effective solution for CSRF, though there are much simpler options, but today’s bots largely have cookie jars so you will likely need a CAPT…

How would it stop XSS? Is it meant to stop attackers from getting JS execution on your site, or to mitigate the attackers' abilities after they have JS execution? I don't see how it would do either.

I mean both CSRF and XSS. If your inputs are named something different on everyone’s machine, per session, you can only XSS yourself. Not very useful, you can already do in many other ways.

Also my comment above is not an endorsement of the methodology, it’s just a thing that happened.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#104

Post by nikanj »

ProfSarkov wrote: post #80
goatinaboat wrote: post #38

Overall, I still believe that neither of the extreme strategies ("always honor autocomplete=off" Is it “extreme” now for a computer to do what the user wants and not what a random Google employee wants? How does this differ from malware?

It's also in the spec. People might not like the spec or it might be incomplete, but adhering to it is a very important part of improving it until it's a good one. Now I'm no webdev, but I could very well imagine that the spec is already a good one. So the situation might be even worse.

The spec only says "should", not "must". Apparently these wingnuts thought that means the spec can be ignored.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#105

Post by obituary_latte »

carstenhag wrote: post #41

As I had already commented on the issue, it completely breaks Germany's main train ticket selling website: https://i.imgur.com/BjYTgSn.png They have tagged the field as autocomplete=off but Chrome just doesn't care. Also see this linked issue where they collected valid use cases for autocomplete=off. They just seem to ignore 452 use cases (I can't comment on the quality of them, I did not read any). https://bugs.chro…

OT: direct link bypassing imgur’s horribly hostile UX https://i.imgur.com/BjYTgSn_d.jpg?maxwidth=1640&shape=&fidel...

Re: Issue 914451: Autofill does not respect autocomplete="off"

#106

Post by sandstrom »

This has turned into a sad chicken-race between Google and developers, with lots of innovative workarounds on Stackoverflow.

Their tactic of overruling web developers doesn't work, it only make things more complicated for everyone, since many of the workarounds have other negative side-effects.

https://stackoverflow.com/questions/12374442/chrome-ignores-...

    ## Example 1

    For a reliable workaround, you can add this code to your layout page:

    
     
    

    Chrome respects autocomplete=off only when there is at least 
    one other input element in the form with any other autocomplete value.



    ## Example 2

    Simply make your input readonly, and on focus, remove it. This is a very 
    simple approach and browsers will not populate readonly inputs. 
    Therefore, this method is accepted and will never be overwritten by 
    future browser updates.

    

    Style your input accordingly so that it does not look like a readonly input.


    ## Example 3

    Tell Chrome that this is a new password input and it won't provide 
    old ones as autocomplete suggestions:

Re: Issue 914451: Autofill does not respect autocomplete="off"

#107

Post by [deleted] »

sky_rw wrote: post #98
Nitramp wrote: post #94

Earlier quoted context omitted.

It's called "user agent", not "developer's agent". We'd be in a terrible situation if the browsers just followed developer's whims. Cf. popup blocking.

Dismissing the above use cases as "developer's whims" is the fundamental issue most people here are taking with these decisions. I think we can all agree that browser behavior should not be left solely up to the developer and is not a black and white issue. Nobody here is arguing that. We are arguing for following a guideline that makes sense. This is why we have the w3c, an organization that attempts to weigh the ne…

[deleted]

Re: Issue 914451: Autofill does not respect autocomplete="off"

#108

Post by ss3000 »

ss3000 wrote: post #87

Setting aside the merits/lack-thereof of this particular decision, Chromium ignoring established web standards like this is especially dangerous as we're trending towards a world where 1) Chromium itself powers the most popular browser in the world by an increasingly unhealthy margin, and 2) even competing browsers are increasingly becoming skins on top of Chromium. We are becoming more and more reliant on the develo…

W.r.t. this particular decision, I feel a more reasonable approach here might have been to allow users to manually trigger autocomplete on individual fields with `autocomplete="off"`, and/or to allow users to strip away the ability to disable autocomplete on a site by site basis.

Analogously to how users are able to selectively grant access to certain default-off features for each website (notifications, camera access), users should also be able to revoke access to certain default-on features for sites that abuse them without affecting the vast majority of sites that use the features for their intended purposes to create a better user experience.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#109

Post by watwut »

Nitramp wrote: post #94
watwut wrote: post #82

Earlier quoted context omitted.

Imo, valid use case for autocomplete=off is "the developer of webapp wants it". Literally that and nothing more.

It's called "user agent", not "developer's agent". We'd be in a terrible situation if the browsers just followed developer's whims. Cf. popup blocking.

If the user installs extension to auto fill everything, it is on him.

When the browser decided to ignore spec, it is not user agency at all.

The need for auto fill is extremely application specific and the action is quite often destructive. And it is developer who gets to be blamed for lost data.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#110

Post by obituary_latte »

ko27 wrote: post #101
ss3000 wrote: post #87

Setting aside the merits/lack-thereof of this particular decision, Chromium ignoring established web standards like this is especially dangerous as we're trending towards a world where 1) Chromium itself powers the most popular browser in the world by an increasingly unhealthy margin, and 2) even competing browsers are increasingly becoming skins on top of Chromium. We are becoming more and more reliant on the develo…

Strictly speaking, Chrome is not ignoring a web standard, since the standard does not require this behavior (no "MUST" keyword).

Well they are ignoring hundreds if not thousands of developers which is the main issue at this point.
Post reply on HN