Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Issue 914451: Autofill does not respect autocomplete="off"

bugs.chromium.org

Post reply on HN
Print view View original

201–210 of 383 posts

Re: Issue 914451: Autofill does not respect autocomplete="off"

#201

Post by watwut »

Vinnl wrote: post #124
sky_rw wrote: post #98

Earlier quoted context omitted.

Dismissing the above use cases as "developer's whims" is the fundamental issue most people here are taking with these decisions. I think we can all agree that browser behavior should not be left solely up to the developer and is not a black and white issue. Nobody here is arguing that. We are arguing for following a guideline that makes sense. This is why we have the w3c, an organization that attempts to weigh the ne…

GP is explicitly not dismissing the above use cases, but merely the supposed justification of "the developer wants it" being enough. > I think we can all agree that browser behavior should not be left solely up to the developer and is not a black and white issue. Nobody here is arguing that. GGP was literally arguing that: https://news.ycombinator.com/item?id=21239172

Should developer be able to make it impossible to close browser or open 100 new tabs? No.

Should developer decide that fields are autocomplete off or green or show javascript warnings? Absolutely yes.

If user wish to change that, users thing. The browser/google has no business to be mediator here, second guess application they know nothing about and manipulate it.

The browser should be predictable, well specified and harmless. It should not force me to convert all ids into random strings just so that random data do not get prefilled in.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#202

Post by yk »

VMG wrote: post #46

Autofill for offscreen elements gives me the creeps even without the data getting misinterpreted

That begs the question, at which point does autofill happen in an iframe? So I pay for an ad, and have a password, creditcard number, address etc. form in the background. Does the browser autofil, or does it autofill when the user starts to fill in a form in the foreground?

Asking for a friend.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#204

Post by rndgermandude »

The_rationalist wrote: post #162
rndgermandude wrote: post #157

Earlier quoted context omitted.

[citation needed] They are now a major user of chromium, and may contribute, but they do not have any say in what goes into chromium. That is still controlled by google employees. If said google employees do not like microsoft patches, they will reject the proposed changes, and microsoft can then at best push them into their own fork.

Google rejecting Microsoft changes has not yet been observed, it could happen. Most people think that Google agenda could conflict with Microsoft agendas. I have read a LOT of chromium issues. I can tell you that the higher management at Google does not dictate chromium changes as they are too technical for them. The truth is, except for maybe a few exceptions, chromium evolve through the decisions of engineers that…

>I can tell you that the higher management at Google does not dictate chromium changes as they are too technical for them.

Tell that to the webRequest API that ablockers use.

>As you said for the exceptions, Microsoft can maintain a fork, it's still order of magnitude more economic and smart than to constantly duplicate work in a redundant browser (firefox)

Chrome is the redundant browser. Firefox was here first.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#205

Post by geofft »

httpsterio wrote: post #176
doctorpangloss wrote: post #43

Earlier quoted context omitted.

Disabling autocomplete is so incredibly frustrating that I ran an extension in Safari to remove the off tag from sites. Of course I want to use KeyChain, the whole point is that touch based ID is more secure.

Touch based are not better. Your fingerprint is not a password, it's just an identifier and shouldn't be treated as a secret.

Your fingerprint is an additional factor (something you are) for the actual better-than-passwords thing here, the isolates processor/storage in your laptop that handles Touch ID (something you have). Without physical possession of the laptop, the fingerprint is useless.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#206

Post by [deleted] »

Santosh83 wrote: post #192
dustinmoris wrote: post #186

Earlier quoted context omitted.

> Your fingerprint is not a password Correct, because a fingerprint makes a password to some extent redundant. > it's just an identifier and shouldn't be treated as a secret Correct, identifiers are not secrets. Your face is not a secret and your fingerprint either. The problem is that we use secrets to identfy someone, when we potentially already have tech which can identify someone without having to remember a secr…

Anonymity is weakened if we tie authentication to biometrics. Something you know (as in password) is always theoretically more secure than something you are (your physical characteristics).

[deleted]

Re: Issue 914451: Autofill does not respect autocomplete="off"

#207

Post by PerfectElement »

I was using Google Places' address auto-complete on a CRM, and most users loved it. Chrome's behavior completely broke this functionality by overlaying their auto-fill on top of Google Places suggestions, with no sane way to disable it. We decided to stop using address auto-complete and force our customers to type the address fields instead.

Ironically, we were paying Google a few thousand dollars per month for this, so they are not getting our revenue as a direct consequence of Chrome's behavior.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#208

Post by user5994461 »

>>> - How to trigger the hiding? - right mouse button menu or (more likely) something in the drop down? where would we put that? ...

Mobiles notoriously don't have mouse buttons, so any UI relying on right-click will not be usable there.

It's odd that Google is considering mouse-based workarounds in all considered solutions, as if unaware of that. or maybe Chromium is only the desktop browser?

Re: Issue 914451: Autofill does not respect autocomplete="off"

#209

Post by shdon »

msclrhd wrote: post #137
anoncake wrote: post #55

Earlier quoted context omitted.

I think we need a way to disable features only for those developers that abuse them. Like uMatrix but built-in and with rules being supplied automatically as ad blocking lists are. You autocomplete=off a password field? That attribute won't have an effect on your site anymore. You auto-play videos when the user doesn't expect it? What videos? The web doesn't support videos – as far as you are concerned. Scroll hijack…

Can we have a reliable cross-browser way to say "this is a change password field, so don't autocomplete it" and "this is an email address field not a username field, so don't autocomplete it with the login username"?

The autocomplete="new-password" (or autocomplete="off" or even autocomplete="some-random-nonsense") method is supposed to be doing that according to the spec. It is ignored by browser developers probably due to abuse. Additionally, all of those also trigger the prompt to save the password. For a password change form, that is the right thing to do, for many others it is not.

I'd very much like to see a way to disable that save prompt too, especially in user management screens. When I create a new user, I want neither my own password to be autofilled, nor do I want to overwrite my saved password with theirs.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#210

Post by TurningCanadian »

klmr wrote: post #181
watwut wrote: post #82

Earlier quoted context omitted.

Imo, valid use case for autocomplete=off is "the developer of webapp wants it". Literally that and nothing more.

Unfortunately a few developers are morons who misuse features, and browser vendors try hard to work around them. Case in point, lots of websites used to put `autocomplete="off"` on password boxes, which breaks some password managers. IIRC that’s why Chrome (and other browsers) decided to sometimes ignore the `autocomplete` attribute in the first place. Of course that doesn’t justify ignoring it completely (just for p…

That was even mandated for all password fields by the PCI scans required for any sites accepting credit cards.
Post reply on HN