Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Issue 914451: Autofill does not respect autocomplete="off"

bugs.chromium.org

Post reply on HN
Print view View original

131–140 of 383 posts

Re: Issue 914451: Autofill does not respect autocomplete="off"

#131

Post by mcv »

isostatic wrote: post #118
ss3000 wrote: post #87

Setting aside the merits/lack-thereof of this particular decision, Chromium ignoring established web standards like this is especially dangerous as we're trending towards a world where 1) Chromium itself powers the most popular browser in the world by an increasingly unhealthy margin, and 2) even competing browsers are increasingly becoming skins on top of Chromium. We are becoming more and more reliant on the develo…

It’s heresy on HN to suggest that a single browser running the web is a bad idea.

I think you're stumbling over too many negations here. A single browser running the web is a bad idea. Diversity in browsers is a good idea. If any statement related to this could be heresy here, then it would be heresy to suggest that a single browser running the web is a good idea.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#132

Post by msclrhd »

obituary_latte wrote: post #114
sandstrom wrote: post #106

This has turned into a sad chicken-race between Google and developers, with lots of innovative workarounds on Stackoverflow. Their tactic of overruling web developers doesn't work, it only make things more complicated for everyone, since many of the workarounds have other negative side-effects. https://stackoverflow.com/questions/12374442/chrome-ignores-... ## Example 1 For a reliable workaround, you can add this cod…

I think it mentioned chrome is even now ignoring ‘display:none’ and ‘visibility:hidden’ declarations so those workarounds no longer work either.

Great! :( Now I need to recheck to see if an autocomplete bug has reappeared where it thinks an email address field is a username field in a change password UI and autocompletes the email address with the username from the login page.

Sigh!

Re: Issue 914451: Autofill does not respect autocomplete="off"

#133

Post by subroutine »

lqet wrote: post #127
subroutine wrote: post #120

Earlier quoted context omitted.

Did you try using a first-letter of a location you commonly use in forms? Here is what mine looks like when I use 'm' (like OP): https://i.imgur.com/NlzVqhT.png and here's what it looks like when I enter 's': https://i.imgur.com/1u4Iy7S.png (actually, S does not autocomplete in the Swiss site)

You are correct! As soon as I submit a search query on sbb.ch, the same problem occurs with that query. I always concluded that it was the fault of the website creators. Guess I have to switch to Firefox...

I think it might have that behavior because they have the auto-complete tag set to...

Though, there is also a lot of other stuff going on in that html element I don't understand.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#134

Post by mcv »

GrayShade wrote: post #51

Firefox used to ignore autocomplete="off" until relatively recently. I'm sick of sites thinking they know better than me -- like those who don't let me paste in the password field. While I understand the good use cases for this attribute, given the binary choice I would rather have it ignored.

That is absolutely stuff that the user needs to be able to override. In fact, anything related to cutting and pasting is not something I think the browser should mess with.

Also: websites that generate a custom login name or password for me so I won't remember it, and then refuse to allow autofill or pasting. Fortunately dev tools are standard on the desktop these days.

(I would really, really like access to dev tools on mobile, though. It's simply necessary to get around some broken websites.)

Re: Issue 914451: Autofill does not respect autocomplete="off"

#135

Post by capableweb »

yoz-y wrote: post #39
pjmlp wrote: post #17

Earlier quoted context omitted.

You still had a choice, nowadays being a Web Developer is almost a synonym for Chrome Developer and it was the IE hatting crowd that made it happen.

Except Chrome is still far below the user-base of IE in its heyday. And the most "valuable" users are all on mobile Safari. So it still makes sense to at least test with that.

"the most "valuable" users are all on mobile Safari"

Not at all, as only 20% of the people using mobile browsers at all, are using Safari.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#136

Post by DCoder »

xmodem wrote: post #13
throwaway2048 wrote: post #9

Earlier quoted context omitted.

plenty of stuff (like credit card info for instance) should absolutely never be auto-completed. The browser storing that sorta stuff to disk is stupid and completely avoidable. Already caught chrome doing this to my Social Security Number before i disabled the functionality entirely. The idea of Chrome automatically auto filling any form it sees labeled "SSN" on any site dosen't inspire confidence.

One CRM webapp I worked on took our frontenders several attempts at different hacks to get Chrome to stop treating the SSN-equiv field as a credit card autofill.

What are the odds that those hacks have been broken by Chrome updates since then?

Re: Issue 914451: Autofill does not respect autocomplete="off"

#137

Post by msclrhd »

anoncake wrote: post #55
jchw wrote: post #37

Because other people here are throwing in their frustrations, I will at least add that on the flip side I have been frustrated by sites that attempt to disable autofill for illegitimate reasons, like attempting to disallow password managers. I think I understand where this is coming from. On the other hand, I, too, have been bit by this at least once, in the past. I think it was easier to just disable it at that time…

I think we need a way to disable features only for those developers that abuse them. Like uMatrix but built-in and with rules being supplied automatically as ad blocking lists are. You autocomplete=off a password field? That attribute won't have an effect on your site anymore. You auto-play videos when the user doesn't expect it? What videos? The web doesn't support videos – as far as you are concerned. Scroll hijack…

Can we have a reliable cross-browser way to say "this is a change password field, so don't autocomplete it" and "this is an email address field not a username field, so don't autocomplete it with the login username"?

Re: Issue 914451: Autofill does not respect autocomplete="off"

#138

Post by tmd83 »

pilif wrote: post #8
tus88 wrote: post #3

I would love it if someone explained how 'autocomplete=off' can lead to abuse of some kind. It seems to reduce the potential for security leaks.

It causes spec-compliant password managers to not work. Unfortunately, disabling autocomplete for password fields is an often used form of security-theatre

Here's the tricky thing and I don't have a solution that doesn't get abused. I hate that lots of bank do this but I also have a use case for password autocomplete=off. We operate in an industry where shared computer access is very common and the risk of users saving password in browser is real and too high.

As I said don't know what the answer is. I definitely want someone using password manager be able to use them. Using a password manager is a conscious choice with setups involved. Browser's default autocomplete is often not. I don't know how to separate these two out.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#139

Post by anticensor »

anoncake wrote: post #55
jchw wrote: post #37

Because other people here are throwing in their frustrations, I will at least add that on the flip side I have been frustrated by sites that attempt to disable autofill for illegitimate reasons, like attempting to disallow password managers. I think I understand where this is coming from. On the other hand, I, too, have been bit by this at least once, in the past. I think it was easier to just disable it at that time…

I think we need a way to disable features only for those developers that abuse them. Like uMatrix but built-in and with rules being supplied automatically as ad blocking lists are. You autocomplete=off a password field? That attribute won't have an effect on your site anymore. You auto-play videos when the user doesn't expect it? What videos? The web doesn't support videos – as far as you are concerned. Scroll hijack…

I even found a name for such an extension: PunishIt.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#140

Post by bayindirh »

TeMPOraL wrote: post #117
sky_rw wrote: post #98

Earlier quoted context omitted.

Dismissing the above use cases as "developer's whims" is the fundamental issue most people here are taking with these decisions. I think we can all agree that browser behavior should not be left solely up to the developer and is not a black and white issue. Nobody here is arguing that. We are arguing for following a guideline that makes sense. This is why we have the w3c, an organization that attempts to weigh the ne…

The issue is that the browser is supposed to be the meeting place for negotiating between developer and user preferences. Its job is to take into account preferences of both sides, and render the site accordingly. Not to be a third party at the negotiating table. Breaking agreed standard in a way that can't be overridden by the user? Browsers should never do that.

> Breaking agreed standard in a way that can't be overridden by the user?

This was done by Microsoft by the old days, now it's Google. How ironic.

Post reply on HN