Issue 914451: Autofill does not respect autocomplete="off" • Hacker News Board

Re: Issue 914451: Autofill does not respect autocomplete="off"

#231

Post by Natanael_L » Sun, Oct 13, 2019, 1:24 PM UTC

jjcm wrote: post #171

ss3000 wrote: post #87

Setting aside the merits/lack-thereof of this particular decision, Chromium ignoring established web standards like this is especially dangerous as we're trending towards a world where 1) Chromium itself powers the most popular browser in the world by an increasingly unhealthy margin, and 2) even competing browsers are increasingly becoming skins on top of Chromium. We are becoming more and more reliant on the develo…

This isn't even the first time we've seen this either. Both Chrome Mobile and Safari Mobile go against the standard and implement `vh` incorrectly. Honestly it seems strange that they go against the standard though considering how much power they have in defining it. Why break from the standard when you can just update the standard. It ends up being the worst of both worlds - documentation that says one thing (that t…

All browsers on iOS are Safari wrappers

Re: Issue 914451: Autofill does not respect autocomplete="off"

#232

Post by jvolkman » Sun, Oct 13, 2019, 1:28 PM UTC

eli wrote: post #226

calcifer wrote: post #216

Earlier quoted context omitted.

> That begs the question Offtopic, but no it doesn't [1]. [1] https://grammarist.com/rhetoric/begging-the-question-fallacy...

When a phrase is used the “wrong” way more often than the right way, it ceases to be wrong.

What about "I could care less"? Seems like that one is just always wrong.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#233

Post by Natanael_L » Sun, Oct 13, 2019, 1:29 PM UTC

summm wrote: post #156

jstanley wrote: post #123

Earlier quoted context omitted.

Really? Seems like it would be crazy not to use it for caching.

The problems are 1) side channels. Caching those would mean that a malicious script could use timing to find out if the user accessed specific other websites. Also it enables a channel for cross-domain communication. 2) malicious user tracking would not work as well anymore, which would be good but Google probably will not support that. Currently they get all those nice http log entries from sites that only include f…

For sensitive files with known names, you should be able to set that the cache is only valid for requests from the same host website (as the server might decide to send another response when the host is different). That would fix the sidechannel.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#234

Post by Natanael_L » Sun, Oct 13, 2019, 1:32 PM UTC

ko27 wrote: post #116

nikanj wrote: post #104

Earlier quoted context omitted.

The spec only says "should", not "must". Apparently these wingnuts thought that means the spec can be ignored.

There are no semantics to discuss. Chrome is spec compliant. That's a fact. Words like "should" and "must" have well defined meaning that is clarified in every spec document, which I would highly advise you to read before writing any further comments and insults.

SHOULD does not equal MAY

Re: Issue 914451: Autofill does not respect autocomplete="off"

#235

Post by enriquepablo » Sun, Oct 13, 2019, 1:33 PM UTC

Santosh83 wrote: post #192

dustinmoris wrote: post #186

Earlier quoted context omitted.

> Your fingerprint is not a password Correct, because a fingerprint makes a password to some extent redundant. > it's just an identifier and shouldn't be treated as a secret Correct, identifiers are not secrets. Your face is not a secret and your fingerprint either. The problem is that we use secrets to identfy someone, when we potentially already have tech which can identify someone without having to remember a secr…

Anonymity is weakened if we tie authentication to biometrics. Something you know (as in password) is always theoretically more secure than something you are (your physical characteristics).

> Anonymity is weakened if we tie authentication to biometrics.

I think you mean pseudonimity. There should be no authentication in anonimity.

> Something you know (as in password) is always theoretically more secure than something you are (your physical characteristics).

If you authenticate, you can use methods that are more or less secure. If you use a password method, and use a secret as password, it will be more secure than if you use a biometric as password.

But the security of the authentication method will bear no weight on the "pseudonimization" - meaning on the difficulty of linking the authenticated identity with your real, legal identity.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#236

Post by Avamander » Sun, Oct 13, 2019, 1:35 PM UTC

Smithalicious wrote: post #221

velox_io wrote: post #220

There's a major security flaw with auto-fill when it comes to passwords. Sure, it's hidden on screen, but you only have to change the password box's type, so it isn't "type='password'" and it is revealed. This only takes a matter of seconds. Chrome should remove the password if there is any attempt to change that form object. This flaw has been there for years, it's actually handy if I'm not sure what the password is…

Is this really an issue? Presumably anyone with access to the browser can acces saved passwords anyways; the censoring only prevents onlookers from reading it.

Actually on Windows at least Chrome asks for a password when trying to view all passwords. So it isn't _that_ easy.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#237

Post by Santosh83 » Sun, Oct 13, 2019, 1:36 PM UTC

enriquepablo wrote: post #235

Santosh83 wrote: post #192

Earlier quoted context omitted.

Anonymity is weakened if we tie authentication to biometrics. Something you know (as in password) is always theoretically more secure than something you are (your physical characteristics).

> Anonymity is weakened if we tie authentication to biometrics. I think you mean pseudonimity. There should be no authentication in anonimity. > Something you know (as in password) is always theoretically more secure than something you are (your physical characteristics). If you authenticate, you can use methods that are more or less secure. If you use a password method, and use a secret as password, it will be more…

It's effectively like using one password for every app/site authentication. What if the hashes/keys leak out? Then how easy would it be to change your keys for other sites while still using the same biometrics?

Re: Issue 914451: Autofill does not respect autocomplete="off"

#238

Post by atVelocet » Sun, Oct 13, 2019, 1:37 PM UTC

carstenhag wrote: post #41

As I had already commented on the issue, it completely breaks Germany's main train ticket selling website: https://i.imgur.com/BjYTgSn.png They have tagged the field as autocomplete=off but Chrome just doesn't care. Also see this linked issue where they collected valid use cases for autocomplete=off. They just seem to ignore 452 use cases (I can't comment on the quality of them, I did not read any). https://bugs.chro…

Finally i know why this happens only in Chromium. This irritates me for quite some time now...

Seems that Chromium based browsers aren't favorable any more: Tracking, Bugs, uBlock extension is flagged, Manifestv3, etc.

But Firefox has the same problem since it ships with Pocket and other sync stuff. I know that they really do care but they have problems of their own which really make me think which browser to use. The actual situation right now is very frustrating...

Re: Issue 914451: Autofill does not respect autocomplete="off"

#239

Post by rc_mob » Sun, Oct 13, 2019, 1:37 PM UTC

sandstrom wrote: post #106

This has turned into a sad chicken-race between Google and developers, with lots of innovative workarounds on Stackoverflow. Their tactic of overruling web developers doesn't work, it only make things more complicated for everyone, since many of the workarounds have other negative side-effects. https://stackoverflow.com/questions/12374442/chrome-ignores-... ## Example 1 For a reliable workaround, you can add this cod…

I still don’t understand why any self respecting developer would use Chrome. I understand why your grandma or parents would use Chrome. But I just cannot compute how a knowledgeable developer would install Chrome.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#240

Post by cdubzzz » Sun, Oct 13, 2019, 1:42 PM UTC

jchw wrote: post #37

Because other people here are throwing in their frustrations, I will at least add that on the flip side I have been frustrated by sites that attempt to disable autofill for illegitimate reasons, like attempting to disallow password managers. I think I understand where this is coming from. On the other hand, I, too, have been bit by this at least once, in the past. I think it was easier to just disable it at that time…

We recently had to go through a website project and disable autocomplete on all password fields after a security scan as part of a PCI compliance process. For autofill password it didn’t seem to have any effect in _any_ browser I tested in. How can it be used to thwart password managers?