271–280 of 383 posts
Earlier quoted context omitted.
In this case, it can be overridden by the user, just not the developer :)
Not really if the user is non-technical and doesn't even know they'd have to override it.
if you would like to autofill the form anyway click"
i made it a little terse, but there has to be a way to make it succinct and human readable.
Earlier quoted context omitted.
It's called "user agent", not "developer's agent". We'd be in a terrible situation if the browsers just followed developer's whims. Cf. popup blocking.
If the user installs extension to auto fill everything, it is on him. When the browser decided to ignore spec, it is not user agency at all. The need for auto fill is extremely application specific and the action is quite often destructive. And it is developer who gets to be blamed for lost data.
Earlier quoted context omitted.
Can anyone explain why the same behavior does not occur on https://www.sbb.ch/ , the Swiss equivalent (which is based on the same software by HaCon)? E: as soon as you submit a search on sbb.ch, the same problem occurs.
Did you try using a first-letter of a location you commonly use in forms? Here is what mine looks like when I use 'm' (like OP): https://i.imgur.com/NlzVqhT.png and here's what it looks like when I enter 's': https://i.imgur.com/1u4Iy7S.png (actually, S does not autocomplete in the Swiss site)
Earlier quoted context omitted.
You didn't have a choice. That was the whole problem!
Well, shortly you won't have a choice anymore. And there was a choice, back then alternatives like Opera, did actually ship their own engine.
There's a major security flaw with auto-fill when it comes to passwords. Sure, it's hidden on screen, but you only have to change the password box's type, so it isn't "type='password'" and it is revealed. This only takes a matter of seconds. Chrome should remove the password if there is any attempt to change that form object. This flaw has been there for years, it's actually handy if I'm not sure what the password is…
As Raymond Chen and others call it: "the airtight hatchway problem."[0] Meaning you're sitting in a context where you can steal the password in infinite ways and complaining about the easiest one. But ultimately fixing that one way still leaves infinite remaining ways.
You're in the superuser context for the webpage. If you can modify the password field's type you can literally do anything to that page.
[0] https://stackoverflow.com/questions/2787853/arent-passwords-...
Relevant reply from a Googler seems to be this: https://bugs.chromium.org/p/chromium/issues/detail?id=914451... by battre@google.com ... which doesn't read at all to me like a "rogue dev" and more like a shared sentiment inside the Chrome team that autocomplete=off should be ignored. At least, if there is a direct spec violation that breaks all kinds of applications and the answer your hear is "oh well, we're working…
Look, I get that this capability is super useful on shopping sites, and I rely on it practically every day.
But, I also build enterprise applications, where Chrome simply would not ever understand or know what would be valid choice.
I do, though; I built it. Invoice Numbers / Pre-Validated Travel Dates & Locations / Pre-Validated Locations / Pre-Validated IssueID that are so esoteric, we have built custom autocomplete that provide additional relevant information / Pre-Validated Users where the number of valid "John Smith"s number in the 10s, and additional meta data must be provided to differentiate.
Application developers need a reliable, durable way to tell the UA that a particular field should never be autofilled or autocompleted. The spec says this is autocomplete=off. Just do that.
Because other people here are throwing in their frustrations, I will at least add that on the flip side I have been frustrated by sites that attempt to disable autofill for illegitimate reasons, like attempting to disallow password managers. I think I understand where this is coming from. On the other hand, I, too, have been bit by this at least once, in the past. I think it was easier to just disable it at that time…
I think we need a way to disable features only for those developers that abuse them. Like uMatrix but built-in and with rules being supplied automatically as ad blocking lists are. You autocomplete=off a password field? That attribute won't have an effect on your site anymore. You auto-play videos when the user doesn't expect it? What videos? The web doesn't support videos – as far as you are concerned. Scroll hijack…
Earlier quoted context omitted.
> Your fingerprint is not a password Correct, because a fingerprint makes a password to some extent redundant. > it's just an identifier and shouldn't be treated as a secret Correct, identifiers are not secrets. Your face is not a secret and your fingerprint either. The problem is that we use secrets to identfy someone, when we potentially already have tech which can identify someone without having to remember a secr…
Um no. The user Name or ID is to identify. The password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security. > then a password or as you say "secret" is not required at all anymore Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfie etc. There's been dozens of ways to exploit over the years, many of which…
With most things you need to authenticate to gain access. Authentication is only trying to solve one question - identifying that a person is who they say they are. If I walk home and my wife sees me, she can identify me immediately by simply seeing my face and other biological attributes which gives her 100% certainty that I am who I am, therefore she doesn't question me on entering the house or calls the police.
If I was to go through some top secret lab experiment which would change my look (make me younger by 10 years or something) then I'd struggle to walk home and convince my wife that I am me without providing additional evidence, like sharing some secrets which only she and I know and we know that nobody else would know.
With technology so far we didn't have the ability to identify someone as confidently and as fast via biometrics (like my wife does) as via other means, which is why a few decades ago we had to invent a workaround, namely username and password - which is a secret that hopefully only me and the website knows. This was to date the best way to identify someone, but times are changing fast, as as biometric identificaiton via technology is advancing fast, we are more and more removing the need of username + password for authentication.
Hope now my point makes sense.
Earlier quoted context omitted.
Not really if the user is non-technical and doesn't even know they'd have to override it.
"this website has asked us to NOT autofill your saved info. if you would like to autofill the form anyway click" i made it a little terse, but there has to be a way to make it succinct and human readable.
But I think in general, some kind of prompt or override would work. I absolutely agree that if a user wants to use the browser autocomplete functionality, they should have an option to do so. I have no understanding for websites that just want to disable autocomplete without replacement.
However the concerns seemed to be about autocomplete being incorrect or conflicting with application-provided lists. I can see how that leads to frustration and confusion with users.
The Chrome team seems to trust its algorithm to an amount where they don't seem to find it necessary to deal with incorrect results - a view which doesn't match reality apparently.