A rare example where an editorialized HN post title is appreciated. Bravo!
Issue 914451: Autofill does not respect autocomplete="off"
21–30 of 383 posts
Re: Issue 914451: Autofill does not respect autocomplete="off"
#22Curious as to the global business impact this has had. I personally have spent at least a dozen hours debugging forms and trying to disable autocomplete/autofill on my kiosk-based applications. How many development hours collectively have been wasted on this unilateral decision.
I have not been this frustrated since the days of writing css for ie6, and at least back then the devs response was more "sorry its our rendering engine" and not battre just saying GFY seemingly out of disdain.
I try to be as free-market as possible but I sure wish that the w3c had some teeth when it came to things like this.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#23I would love it if someone explained how 'autocomplete=off' can lead to abuse of some kind. It seems to reduce the potential for security leaks.
From previous discussions I remember payment and bank forms use autocomplete=off and chrome developers don't like it, they want card numbers to be pre-filled.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#24A few years ago, I left a $1000 tip at the restaurant up the street because Chrome filled out the tip field with my zip code (which thankfully merely defaulted to max $1000 instead). The tip field was off-screen, and the ordering software didn't have a confirmation screen, just a "we just charged your card $X amount" screen, which made my eyes boggle. EDIT: Looking at the original March 17th, 2015 bug, it would have…
Fun fact: something similar once happened in production in the early days of an iPad-based point of sale startup.
In certain cases, a previously-entered zip code was interpreted as the number of cents to tip.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#25Earlier quoted context omitted.
It causes spec-compliant password managers to not work. Unfortunately, disabling autocomplete for password fields is an often used form of security-theatre
Ok, but how is that abuse? And if autocomplete=off is part of the html standard, how are the password managers spec compliant if they can't deal with it? Are people doing this just to annoy users who prefer password managers?
>Are people doing this just to annoy users who prefer password managers?
People are doing it because they don't understand password managers, and think blocking them makes people more secure. They believe that if a password is in a manager, that password is less secure than if that password was purely in the user's head.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#26I guess this bug is the real reason why I turned off auto-fill in the browser a while ago, because it acted weird a lot of times.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#27Earlier quoted context omitted.
They acted predictably by never updating IE and letting it stagnate. Hard to see how that is better in any meaningful way.
You still had a choice, nowadays being a Web Developer is almost a synonym for Chrome Developer and it was the IE hatting crowd that made it happen.
You didn't have a choice. That was the whole problem!
Re: Issue 914451: Autofill does not respect autocomplete="off"
#28A few years ago, I left a $1000 tip at the restaurant up the street because Chrome filled out the tip field with my zip code (which thankfully merely defaulted to max $1000 instead). The tip field was off-screen, and the ordering software didn't have a confirmation screen, just a "we just charged your card $X amount" screen, which made my eyes boggle. EDIT: Looking at the original March 17th, 2015 bug, it would have…
(How) did you resolve this?
Re: Issue 914451: Autofill does not respect autocomplete="off"
#29I ran into this last week (with LastPass, not Chrome - this seems to be a common practice):
I have a form where users enter information about their suppliers (I make restaurant management software). This includes a field for the contact email address, which LastPass was autofilling the email address the user used to log in. This happened silently, quickly enough that users wouldn't notice it on page transition, and would overwrite the initial value. Even with autocomplete=off.
This was a DATA LOSS bug - users would load the page, make a few changes, save, and not notice that they'd lost the email address they'd stored for the supplier. Fortunately LP has a method to force disabling of autofill (data-lpignore=on), but this could have all been avoided if they'd followed the spec I was relying on. I still don't know if some other password manager, maybe built in to Firefox or something, will make the same mistake, haven't had time to check yet.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#30Earlier quoted context omitted.
> It seems to reduce the potential for security leaks Misguided views like this are exactly how. Turning off autocomplete doesn't improve any sort of security, since the site already needs to trust the browser. It serves no purpose other than to frustrate the user, and might even reduce security if it prevents the user from easily making use of a password manager.
plenty of stuff (like credit card info for instance) should absolutely never be auto-completed. The browser storing that sorta stuff to disk is stupid and completely avoidable. Already caught chrome doing this to my Social Security Number before i disabled the functionality entirely. The idea of Chrome automatically auto filling any form it sees labeled "SSN" on any site dosen't inspire confidence.
> (like credit card info for instance) should absolutely never be auto-completed
One of LastPass's advertised features is credit card autofill. I assume they advertise it because some users like it.