Is "ignoring the specification" an extreme, now? Are we seriously expected to entertain this mess? So glad I switched to Firefox all those years ago.
Google slaves came to downvote you after someone said this on their internal chat lol.
Issue 914451: Autofill does not respect autocomplete="off"
191–200 of 383 posts
Re: Issue 914451: Autofill does not respect autocomplete="off"
#192Earlier quoted context omitted.
Touch based are not better. Your fingerprint is not a password, it's just an identifier and shouldn't be treated as a secret.
> Your fingerprint is not a password Correct, because a fingerprint makes a password to some extent redundant. > it's just an identifier and shouldn't be treated as a secret Correct, identifiers are not secrets. Your face is not a secret and your fingerprint either. The problem is that we use secrets to identfy someone, when we potentially already have tech which can identify someone without having to remember a secr…
Anonymity is weakened if we tie authentication to biometrics. Something you know (as in password) is always theoretically more secure than something you are (your physical characteristics).
Re: Issue 914451: Autofill does not respect autocomplete="off"
#193Earlier quoted context omitted.
Touch based are not better. Your fingerprint is not a password, it's just an identifier and shouldn't be treated as a secret.
> Your fingerprint is not a password Correct, because a fingerprint makes a password to some extent redundant. > it's just an identifier and shouldn't be treated as a secret Correct, identifiers are not secrets. Your face is not a secret and your fingerprint either. The problem is that we use secrets to identfy someone, when we potentially already have tech which can identify someone without having to remember a secr…
Um no. The user Name or ID is to identify.
The password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security.
> then a password or as you say "secret" is not required at all anymore
Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfie etc. There's been dozens of ways to exploit over the years, many of which have hit HN.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#194Earlier quoted context omitted.
> Your fingerprint is not a password Correct, because a fingerprint makes a password to some extent redundant. > it's just an identifier and shouldn't be treated as a secret Correct, identifiers are not secrets. Your face is not a secret and your fingerprint either. The problem is that we use secrets to identfy someone, when we potentially already have tech which can identify someone without having to remember a secr…
Anonymity is weakened if we tie authentication to biometrics. Something you know (as in password) is always theoretically more secure than something you are (your physical characteristics).
Anonymity is of course weakened, but that is a different debate. Currently there is no anonymity at all if your account is linked to your email address, which you've also used to register your online banking account, your credit card verification, your PayPal account, etc. and when you have your mobile phone number confirmed, etc.
A password gives you 0 extra anonymity in this case. All it is used if for "identifycation" and in this regard it sucks in comparison to true biologial identification.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#195With the new direction chrome is going I wouldn't mind putting "works best on anything but Chrome" on my next web project.
I was thinking the same, websites should just have a big popup somewhere saying that the website might not work on Google Chrome, because it is W3C compliant and Google Chrome doesn't implement W3C standards, whith links to download alternatives browsers.
Please go read the spec, you will find that Chrome is perfectly compliant with it regarding the autocomplete attribute handling.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#196Is "ignoring the specification" an extreme, now? Are we seriously expected to entertain this mess? So glad I switched to Firefox all those years ago.
The spec says SHOULD though, not MUST. Chrome is compliant.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#197Earlier quoted context omitted.
Imo, valid use case for autocomplete=off is "the developer of webapp wants it". Literally that and nothing more.
Unfortunately a few developers are morons who misuse features, and browser vendors try hard to work around them. Case in point, lots of websites used to put `autocomplete="off"` on password boxes, which breaks some password managers. IIRC that’s why Chrome (and other browsers) decided to sometimes ignore the `autocomplete` attribute in the first place. Of course that doesn’t justify ignoring it completely (just for p…
Exactly. Autocomplete=off gets misused. For example, there was a browsergame I played where because of idiotic "security considerations" autocomplete=off got applied to the login screen. At that time for me that meant typing in the password manually, thus picking a bad password.
So it's a good thing in that situation when the browser ignores the attribute.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#198Earlier quoted context omitted.
> Your fingerprint is not a password Correct, because a fingerprint makes a password to some extent redundant. > it's just an identifier and shouldn't be treated as a secret Correct, identifiers are not secrets. Your face is not a secret and your fingerprint either. The problem is that we use secrets to identfy someone, when we potentially already have tech which can identify someone without having to remember a secr…
Um no. The user Name or ID is to identify. The password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security. > then a password or as you say "secret" is not required at all anymore Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfie etc. There's been dozens of ways to exploit over the years, many of which…
> the password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security.
You talk absolute nonsense. You ID is not secured by your password LOOOOL. For example, your email is not secure. It is public. I can send you.. drumroll.. a mail there. So is your Facebook username. It is not secure. It is just a name which is public and tells everyone who you are. The password is the only thing that is used to make sure that only you can log in as you. It is a way of identifying that you are you. Nothing else.
> Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfir etc.
There is more and less secure biometrics. There are biometrics, which cannot be copied or cut off that easily. At the end of the day, your biological composition makes you who you are. If someone can truly fake all your biological attributes, then maybe you have a bigger problem than someone logging in with your online account. They probably can do worse things at this point.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#199Earlier quoted context omitted.
Um no. The user Name or ID is to identify. The password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security. > then a password or as you say "secret" is not required at all anymore Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfie etc. There's been dozens of ways to exploit over the years, many of which…
> the password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security. You talk absolute nonsense. You ID is not secured by your password LOOOOL. For example, your email is not secure. It is public. I can send you.. drumroll.. a mail there. So is your Facebook username. It is not secure. It is just a name which is public and tells everyone who you are. The password is t…
How many emails require a password to send to them? None. It's identifier. The password is the security.
Using biometrics - an identifier - for security as well is a compromise for convenience. As you say yourself biometrics make you who you are, they don't secure who you are.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#200Because other people here are throwing in their frustrations, I will at least add that on the flip side I have been frustrated by sites that attempt to disable autofill for illegitimate reasons, like attempting to disallow password managers. I think I understand where this is coming from. On the other hand, I, too, have been bit by this at least once, in the past. I think it was easier to just disable it at that time…
Chrome explains in their security FAQ [0] why they don't adhere to autocomplete=off for password fields. They could still follow it for other fields. 0: https://chromium.googlesource.com/chromium/src/+/master/docs...
Of course then websites will just stop using password fields and that is awful for security and convinced.