Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Issue 914451: Autofill does not respect autocomplete="off"

bugs.chromium.org

Post reply on HN
Print view View original

171–180 of 383 posts

Re: Issue 914451: Autofill does not respect autocomplete="off"

#171

Post by jjcm »

ss3000 wrote: post #87

Setting aside the merits/lack-thereof of this particular decision, Chromium ignoring established web standards like this is especially dangerous as we're trending towards a world where 1) Chromium itself powers the most popular browser in the world by an increasingly unhealthy margin, and 2) even competing browsers are increasingly becoming skins on top of Chromium. We are becoming more and more reliant on the develo…

This isn't even the first time we've seen this either. Both Chrome Mobile and Safari Mobile go against the standard and implement `vh` incorrectly.

Honestly it seems strange that they go against the standard though considering how much power they have in defining it. Why break from the standard when you can just update the standard. It ends up being the worst of both worlds - documentation that says one thing (that they had a hand in building) and an implementation that does something completely different.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#172

Post by xg15 »

muro wrote: post #130
TeMPOraL wrote: post #117

Earlier quoted context omitted.

The issue is that the browser is supposed to be the meeting place for negotiating between developer and user preferences. Its job is to take into account preferences of both sides, and render the site accordingly. Not to be a third party at the negotiating table. Breaking agreed standard in a way that can't be overridden by the user? Browsers should never do that.

In this case, it can be overridden by the user, just not the developer :)

Not really if the user is non-technical and doesn't even know they'd have to override it.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#173

Post by LoSboccacc »

masklinn wrote: post #151
subroutine wrote: post #133

Earlier quoted context omitted.

I think it might have that behavior because they have the auto-complete tag set to... Though, there is also a lot of other stuff going on in that html element I don't understand.

That's an interesting hack as autocomplete=new-password will generally disable autocomplete. Though it may not work every time, as browsers & password managers might also suggest new passwords (following whatever their internal generation rules are).

randomised field id works as well

Re: Issue 914451: Autofill does not respect autocomplete="off"

#174

Post by jrockway »

obituary_latte wrote: post #110
ko27 wrote: post #101

Earlier quoted context omitted.

Strictly speaking, Chrome is not ignoring a web standard, since the standard does not require this behavior (no "MUST" keyword).

Well they are ignoring hundreds if not thousands of developers which is the main issue at this point.

By ignoring "hundreds if not thousands of developers" they are respecting the wishes of millions of end-users that don't want the site owner to decide what they can and can't autofill.

Obviously a simple boolean is the wrong design here. But can you suggest a better one?

Re: Issue 914451: Autofill does not respect autocomplete="off"

#176

Post by httpsterio »

doctorpangloss wrote: post #43
jchw wrote: post #37

Because other people here are throwing in their frustrations, I will at least add that on the flip side I have been frustrated by sites that attempt to disable autofill for illegitimate reasons, like attempting to disallow password managers. I think I understand where this is coming from. On the other hand, I, too, have been bit by this at least once, in the past. I think it was easier to just disable it at that time…

Disabling autocomplete is so incredibly frustrating that I ran an extension in Safari to remove the off tag from sites. Of course I want to use KeyChain, the whole point is that touch based ID is more secure.

Touch based are not better. Your fingerprint is not a password, it's just an identifier and shouldn't be treated as a secret.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#177

Post by vidarh »

flaviu1 wrote: post #7
tus88 wrote: post #3

I would love it if someone explained how 'autocomplete=off' can lead to abuse of some kind. It seems to reduce the potential for security leaks.

> It seems to reduce the potential for security leaks Misguided views like this are exactly how. Turning off autocomplete doesn't improve any sort of security, since the site already needs to trust the browser. It serves no purpose other than to frustrate the user, and might even reduce security if it prevents the user from easily making use of a password manager.

It does sometimes improve security for the user.

This happens when the auto-complete triggers on things it shouldn't and the user doesn't notice and submits personal details they never wanted to send to the site at all.

I've had to struggle a lot with working around Google's wrong-headed approach to this because this actually happens to real users. It's downright irresponsible, and I think frankly it's just a question of time before EU data protection watchdogs starts to take notice. All it will take is a sufficiently bad case of unintended disclosure of personal information (e.g. imagine a domestic abuse victim accidentally having their new address auto-completed in just the wrong situation).

(EDIT: this also easily happens with web apps where someone has to enter details for different users in the same forms multiple times; it get's very easy to end up not noticing Chrome auto-completing details for unrelated users; if that information is later visible to the user, it creates a real risk of leaking personal information)

Re: Issue 914451: Autofill does not respect autocomplete="off"

#178

Post by vidarh »

dazbradbury wrote: post #141

I'm not sure who Chrome think they're helping. We get many, many users contacting our support team because of this feature / bug on https://www.openrent.co.uk . It's frustrating, we've used workarounds, which then stop working and reports come flooding in again. It's crazy to me that the Chrome team think this is better for users, and that there isn't a more intelligent workaround for sites abusing autocomplete=off.

At some point the alternative will be to implement a custom input control, which will just be awful in all kinds of ways, but it's just as awful to have Chrome think it knows best in some contexts.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#179

Post by jefftk »

andrewstuart wrote: post #89

The weird thing is that there's other teams within Google who offer autocomplete libraries that simply don't work because Chrome overlays it's own autocomplete on top. The maps team seems to have given up on trying to resolve that. Chrome team have made a judgement that autocomplete is required and no-one - not even other teams within Google are allowed to override that functionality. It's weird.

> not even other teams within Google are allowed to override that functionality

Isn't that how things should work? If other teams within Google had a special way to override autocomplete wouldn't that be worse?

(Disclosure: I work at Google)

Re: Issue 914451: Autofill does not respect autocomplete="off"

#180

Post by jefftk »

londons_explore wrote: post #76
Hokusai wrote: post #42

I do not get from where it comes that it is a rogue developer. I have worked in many companies where developers make mistakes. And, it is always the ways of working, giving more priority to features than quality, and similar cultural attributes of the company at fault. The only time I saw this being a rogue developer was a commit and run done by a guy on his last day. It is easy to blame one person when actually is a…

I agree - and in fact, I think accusing this guy of being rogue is an unnecessary direct attack on him/her. They are just doing their job, and in this case, acting in what they believe is best way for users. Here on HN, it seems most disagree, but that is still no reason to accuse someone of being rogue. Headline should be "Google Chrome actively ignores HTML5 standard"

The standard says "SHOULD", not "MUST".

(Disclosure: I work for Google)

Post reply on HN