Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Issue 914451: Autofill does not respect autocomplete="off"

bugs.chromium.org

Post reply on HN
Print view View original

161–170 of 383 posts

Re: Issue 914451: Autofill does not respect autocomplete="off"

#161

Post by iforgotpassword »

azernik wrote: post #29

I ran into this last week (with LastPass, not Chrome - this seems to be a common practice): I have a form where users enter information about their suppliers (I make restaurant management software). This includes a field for the contact email address, which LastPass was autofilling the email address the user used to log in. This happened silently, quickly enough that users wouldn't notice it on page transition, and w…

Similar thing at my last job. Some internal webapp that was communicating with a bunch of other services. Whenever you edited the connection to such a backend you'd get a bunch of settings to change, as well as - depending on the backend type - credentials to talk to that other service. So if you were saving your credentials to that web app, whenever you edited such a backend connection, it would overwrite the username and password field in that settings page with your credentials for the web app itself. Even though the fields were pre-filled with the current values in the html the server sent you, chrome just went ahead and replaced them on page load. It happened more than once someone accidentally saved the settings and replaced the actual credentials for the backend with their login credentials for the webapp. So anyone accessing that edit page afterwards could steal their coworkers password.

So at some point a colleague went ahead, found the template and added a fake username and password field at the very beginning of the form that had something like "position: absolute; top: -2000" (after an hour of failed attempts with the autofill attribute and using hidden fields and whatnot).

So yes, f*ck those Google devs on their high horse.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#162

Post by The_rationalist »

rndgermandude wrote: post #157
The_rationalist wrote: post #152

Earlier quoted context omitted.

Update your beliefs.. Microsoft is now a major contributor to chromium.

[citation needed] They are now a major user of chromium, and may contribute, but they do not have any say in what goes into chromium. That is still controlled by google employees. If said google employees do not like microsoft patches, they will reject the proposed changes, and microsoft can then at best push them into their own fork.

Google rejecting Microsoft changes has not yet been observed, it could happen.

Most people think that Google agenda could conflict with Microsoft agendas. I have read a LOT of chromium issues. I can tell you that the higher management at Google does not dictate chromium changes as they are too technical for them. The truth is, except for maybe a few exceptions, chromium evolve through the decisions of engineers that want to create the best possible product. They are not different to Firefox or edge engineers. Thus they should collaborate pretty well and a Google and Microsoft team should not have more "conflicts" than between two Google internal teams. As you said for the exceptions, Microsoft can maintain a fork, it's still order of magnitude more economic and smart than to constantly duplicate work in a redundant browser (firefox)

You can see a list of their merged pull requests here: https://chromium-review.googlesource.com/q/author:*.microsof...

BTW I really wonder when Apple will switch back to chromium.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#164

Post by platz »

> Comment 66 by battre@google.com on Tue, Oct 8, 2019, 3:48 AM CDT (5 days ago) - Overall, I still believe that neither of the extreme strategies ("always honor autocomplete=off" and "never honor autocomplete=off") are good

https://bugs.chromium.org/p/chromium/issues/detail?id=914451...

We're in for the Long haul on this one.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#165

Post by gnud »

jchw wrote: post #37

Because other people here are throwing in their frustrations, I will at least add that on the flip side I have been frustrated by sites that attempt to disable autofill for illegitimate reasons, like attempting to disallow password managers. I think I understand where this is coming from. On the other hand, I, too, have been bit by this at least once, in the past. I think it was easier to just disable it at that time…

Chrome explains in their security FAQ [0] why they don't adhere to autocomplete=off for password fields.

They could still follow it for other fields.

0: https://chromium.googlesource.com/chromium/src/+/master/docs...

Re: Issue 914451: Autofill does not respect autocomplete="off"

#167

Post by obituary_latte »

ko27 wrote: post #122
obituary_latte wrote: post #110

Earlier quoted context omitted.

Well they are ignoring hundreds if not thousands of developers which is the main issue at this point.

Well, that's what Chrome always does? Just like the preventDefault breaking change thing. They have no problem ignoring developers if they think it will be a net benefit for user experience.

Yup. Very frustrating as a dev. I don’t really get how they rationalize it either - having their autofill appear over and obstruct a developers autocomplete functionality is not user friendly!

Re: Issue 914451: Autofill does not respect autocomplete="off"

#168

Post by obituary_latte »

msclrhd wrote: post #132
obituary_latte wrote: post #114

Earlier quoted context omitted.

I think it mentioned chrome is even now ignoring ‘display:none’ and ‘visibility:hidden’ declarations so those workarounds no longer work either.

Great! :( Now I need to recheck to see if an autocomplete bug has reappeared where it thinks an email address field is a username field in a change password UI and autocompletes the email address with the username from the login page. Sigh!

I feel your pain - sorry you have to deal with it. I’m working on a client data management app and I’m having issues everywhere with this. It’s been an open ticket on Jira for months!

Re: Issue 914451: Autofill does not respect autocomplete="off"

#170

Post by Hamuko »

Nitramp wrote: post #94
watwut wrote: post #82

Earlier quoted context omitted.

Imo, valid use case for autocomplete=off is "the developer of webapp wants it". Literally that and nothing more.

It's called "user agent", not "developer's agent". We'd be in a terrible situation if the browsers just followed developer's whims. Cf. popup blocking.

But I'm developing the application for the users.

It's pretty annoying that we have to make hacks for a client card page not to automatically assume you want to fill in your own details.

Post reply on HN