Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Issue 914451: Autofill does not respect autocomplete="off"

bugs.chromium.org

Post reply on HN
Print view View original

151–160 of 383 posts

Re: Issue 914451: Autofill does not respect autocomplete="off"

#151

Post by masklinn »

subroutine wrote: post #133
lqet wrote: post #127

Earlier quoted context omitted.

You are correct! As soon as I submit a search query on sbb.ch, the same problem occurs with that query. I always concluded that it was the fault of the website creators. Guess I have to switch to Firefox...

I think it might have that behavior because they have the auto-complete tag set to... Though, there is also a lot of other stuff going on in that html element I don't understand.

That's an interesting hack as autocomplete=new-password will generally disable autocomplete.

Though it may not work every time, as browsers & password managers might also suggest new passwords (following whatever their internal generation rules are).

Re: Issue 914451: Autofill does not respect autocomplete="off"

#152

Post by The_rationalist »

pjmlp wrote: post #69
IfOnlyYouKnew wrote: post #53

Earlier quoted context omitted.

You must have lived in a different past than me. IE was far more dominant, and browsers actually had meaningful differences back then. Porting CSS written for IE to Firefox could easily take 50% of the initial implementation time, if not 100%. Today, it's not completely uncommon to have something developed on Chrome working in Firefox and Safari without any changes. And the most significant problem with IE was obviou…

Yeah all those Web sites that are Chrome only must be a product of my imagination. It doesn't matter if Chrome is open-source, when it is technically owned by a single corporation.

Update your beliefs.. Microsoft is now a major contributor to chromium.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#153

Post by masklinn »

TekMol wrote: post #40

I guess this will lead to a horrible coding style where instead of having this in the form: We will see stuff like this: Where developers use some type of abstraction that generates a random id for each field and then assigns it to the original value server side or in javascript. Just like they already randomise asset filenames to avoid caching.

MDN literally mentions jquery.disableAutoFill which basically does that for you under the cover (scrambling the name on display, and unscrambling on submission).

Re: Issue 914451: Autofill does not respect autocomplete="off"

#154

Post by Rexxar »

watwut wrote: post #82
carstenhag wrote: post #41

As I had already commented on the issue, it completely breaks Germany's main train ticket selling website: https://i.imgur.com/BjYTgSn.png They have tagged the field as autocomplete=off but Chrome just doesn't care. Also see this linked issue where they collected valid use cases for autocomplete=off. They just seem to ignore 452 use cases (I can't comment on the quality of them, I did not read any). https://bugs.chro…

Imo, valid use case for autocomplete=off is "the developer of webapp wants it". Literally that and nothing more.

It's the same meaning but I would prefer "just follow the specification an let developer decide what they want"

Re: Issue 914451: Autofill does not respect autocomplete="off"

#155

Post by rndgermandude »

pilif wrote: post #8
tus88 wrote: post #3

I would love it if someone explained how 'autocomplete=off' can lead to abuse of some kind. It seems to reduce the potential for security leaks.

It causes spec-compliant password managers to not work. Unfortunately, disabling autocomplete for password fields is an often used form of security-theatre

Then only ignore autocomplete=off for forms that have password fields.

Sure, stupid devs can still work around that too, but so can they work around the current ingore-always behavior.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#156

Post by summm »

jstanley wrote: post #123
StavrosK wrote: post #99

Earlier quoted context omitted.

Subresource integrity is for ensuring that you got the right file (it fails if you didn't), it doesn't do anything with the cache, unfortunately.

Really? Seems like it would be crazy not to use it for caching.

The problems are 1) side channels. Caching those would mean that a malicious script could use timing to find out if the user accessed specific other websites. Also it enables a channel for cross-domain communication. 2) malicious user tracking would not work as well anymore, which would be good but Google probably will not support that. Currently they get all those nice http log entries from sites that only include fonts etc.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#157

Post by rndgermandude »

The_rationalist wrote: post #152
pjmlp wrote: post #69

Earlier quoted context omitted.

Yeah all those Web sites that are Chrome only must be a product of my imagination. It doesn't matter if Chrome is open-source, when it is technically owned by a single corporation.

Update your beliefs.. Microsoft is now a major contributor to chromium.

[citation needed]

They are now a major user of chromium, and may contribute, but they do not have any say in what goes into chromium. That is still controlled by google employees. If said google employees do not like microsoft patches, they will reject the proposed changes, and microsoft can then at best push them into their own fork.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#158

Post by summm »

noselasd wrote: post #92
xg15 wrote: post #88

Earlier quoted context omitted.

> Just like they already randomise asset filenames to avoid caching. But why? Isn't the whole point of caching to improve delivery if static assets? Did they run into staleness problems? Then why not use if-modified-since/if-none-match?

You are assuming browsers(there are many more than chrome&ff) ,proxies, etc. do caching correctly.

And you are assuming web devs could configure their servers properly. Anyway, it all boils down to the mentality of lowest common denominator: using that workaround, nobody has any incentive to fix their proxy.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#159

Post by pantalaimon »

dmix wrote: post #113
VMG wrote: post #46

Autofill for offscreen elements gives me the creeps even without the data getting misinterpreted

This is why form elements should never be hidden after loading. Display none should be the default in the HTML for non-relevant content, which should be enough for most autofillers. It also prevents flashing of content when autofillers try to populate it, causing the hiding to delay, which I recently saw in a production app. Frameworks like React and Vue don’t even render the HTML into the DOM until conditions are me…

If you want to be malicious and capture wrong auto fill data, wouldn't a simple AJAX request on change be enough to capture sensitive data before the user gets a chance to correct it?

Re: Issue 914451: Autofill does not respect autocomplete="off"

#160

Post by EugeneOZ »

sandstrom wrote: post #106

This has turned into a sad chicken-race between Google and developers, with lots of innovative workarounds on Stackoverflow. Their tactic of overruling web developers doesn't work, it only make things more complicated for everyone, since many of the workarounds have other negative side-effects. https://stackoverflow.com/questions/12374442/chrome-ignores-... ## Example 1 For a reliable workaround, you can add this cod…

I haven't tried it, but maybe div with "contenteditable" could help?
Post reply on HN