Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Issue 914451: Autofill does not respect autocomplete="off"

bugs.chromium.org

Post reply on HN
Print view View original

251–260 of 383 posts

Re: Issue 914451: Autofill does not respect autocomplete="off"

#251

Post by Rapzid »

michaelt wrote: post #211
watwut wrote: post #201

Earlier quoted context omitted.

Should developer be able to make it impossible to close browser or open 100 new tabs? No. Should developer decide that fields are autocomplete off or green or show javascript warnings? Absolutely yes. If user wish to change that, users thing. The browser/google has no business to be mediator here, second guess application they know nothing about and manipulate it. The browser should be predictable, well specified and…

I've heard plenty of people on HN say password managers should ignore autocomplete=off and I agree with them. Because that setting is mostly applied by organisations like banks who incorrectly think they're making things more secure by doing so. IMHO there are cases where autocomplete=off should be respected, and other times when it shouldn't be - it's certainly not as simple as saying always do or always don't respe…

Well, all major browsers now ignore it on password fields so the browser ship has sailed on that one:

> This is the behavior in Firefox (since version 38), Google Chrome (since 34), and Internet Explorer (since version 11). - MDN

Re: Issue 914451: Autofill does not respect autocomplete="off"

#252

Post by AJ007 »

pantalaimon wrote: post #159
dmix wrote: post #113

Earlier quoted context omitted.

This is why form elements should never be hidden after loading. Display none should be the default in the HTML for non-relevant content, which should be enough for most autofillers. It also prevents flashing of content when autofillers try to populate it, causing the hiding to delay, which I recently saw in a production app. Frameworks like React and Vue don’t even render the HTML into the DOM until conditions are me…

If you want to be malicious and capture wrong auto fill data, wouldn't a simple AJAX request on change be enough to capture sensitive data before the user gets a chance to correct it?

Yes, and there are popular third party analytics platforms that record all activity on a page, which includes not just every key press, but the speed at which it was done, with or without a submission of the form.

Web browsers should never, ever use auto fill unless the user has already entered that information on that domain already. Popular domains that host third party content should never be able to auto fill.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#253

Post by AJ007 »

watwut wrote: post #201
Vinnl wrote: post #124

Earlier quoted context omitted.

GP is explicitly not dismissing the above use cases, but merely the supposed justification of "the developer wants it" being enough. > I think we can all agree that browser behavior should not be left solely up to the developer and is not a black and white issue. Nobody here is arguing that. GGP was literally arguing that: https://news.ycombinator.com/item?id=21239172

Should developer be able to make it impossible to close browser or open 100 new tabs? No. Should developer decide that fields are autocomplete off or green or show javascript warnings? Absolutely yes. If user wish to change that, users thing. The browser/google has no business to be mediator here, second guess application they know nothing about and manipulate it. The browser should be predictable, well specified and…

* should a developer be able to hijack browser shortcuts, no. Should a developer be able to disable right click functionality, no.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#254

Post by driverdan »

cdubzzz wrote: post #240
jchw wrote: post #37

Because other people here are throwing in their frustrations, I will at least add that on the flip side I have been frustrated by sites that attempt to disable autofill for illegitimate reasons, like attempting to disallow password managers. I think I understand where this is coming from. On the other hand, I, too, have been bit by this at least once, in the past. I think it was easier to just disable it at that time…

We recently had to go through a website project and disable autocomplete on all password fields after a security scan as part of a PCI compliance process. For autofill password it didn’t seem to have any effect in _any_ browser I tested in. How can it be used to thwart password managers?

Why would you need to disable autocomplete passwords for PCI compliance?

Re: Issue 914451: Autofill does not respect autocomplete="off"

#255

Post by antisemiotic »

erichurkman wrote: post #245
klmr wrote: post #181

Earlier quoted context omitted.

Unfortunately a few developers are morons who misuse features, and browser vendors try hard to work around them. Case in point, lots of websites used to put `autocomplete="off"` on password boxes, which breaks some password managers. IIRC that’s why Chrome (and other browsers) decided to sometimes ignore the `autocomplete` attribute in the first place. Of course that doesn’t justify ignoring it completely (just for p…

Now they need to ban intercepting/blocking `onpaste` in form fields.

This has the added benefit of disabling local password managers like PasswordSafe. Might as well throw in some stupid password policy (like maximum password length, or banning some special characters but not explaining which) to make sure stubborn users won't use a secure password even if they're willing to type it in every time.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#256

Post by Santosh83 »

scient wrote: post #225
Santosh83 wrote: post #192

Earlier quoted context omitted.

Anonymity is weakened if we tie authentication to biometrics. Something you know (as in password) is always theoretically more secure than something you are (your physical characteristics).

I think the statement you make about "something you know" always being more secure is not nearly as clear cut as you present it. A combination of "something you know" and "something you have" is always going to be a very strong authentication scenario, and making "something you have" a non-hackable thing that truly only you can have (i.e not a USB key or a TOTP seed etc.) is a good choice. The catch here is that when…

> And using any of these (ideally) has absolutely nothing to do with anonymity. You are not anonymous online regardless of what you use for authentication - and you are frankly not smart if you assume thats the case. A company offering a service with biometrics is no different from a company doing the same based on email/username and a password, if they do privacy and security right.

Why should I use unchangeable, personally identifiable details when logging into some random joe's website? The mechanics of it are also tied to specific devices if I'm not wrong. I can't just login anywhere without risking leaking secrets. When did fingerprints, iris patterns and DNA go from necessary tools in law enforcement and biology (and for highly secure installations) into casual usage all over the place?

Re: Issue 914451: Autofill does not respect autocomplete="off"

#259

Post by mfer »

danso wrote: post #242
rc_mob wrote: post #239

Earlier quoted context omitted.

I still don’t understand why any self respecting developer would use Chrome. I understand why your grandma or parents would use Chrome. But I just cannot compute how a knowledgeable developer would install Chrome.

Because Chrome has 70% of the global market share, and web developers should know what their customers use?

When IE had a huge market share I would use and build with chrome then test and correct in IE. It’s possible to support clients while not personally supporting this.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#260

Post by redshirtrob »

jvolkman wrote: post #232
eli wrote: post #226

Earlier quoted context omitted.

When a phrase is used the “wrong” way more often than the right way, it ceases to be wrong.

What about "I could care less"? Seems like that one is just always wrong.

Yeah. But people say it enough I've started mentally converting it to:

"I _could_ care less (but I can't be bothered)."

Post reply on HN