Live data from Hacker News

Issue 914451: Autofill does not respect autocomplete="off"

bugs.chromium.org

291–300 of 383 posts

Re: Issue 914451: Autofill does not respect autocomplete="off"

#291
post #95

Earlier quoted context omitted.

> somewhere along the journey of the web autocomplete=off become a default for many form fields, without any real thought being given as to whether or not that was good for users And here I was, all along, thinking that website authors were in control of how their websites behaved. How silly of me!

It's complicated. Sometimes website authors do silly things that negatively impact users; browsers ought to help (without breaking things!) where possible. Some daily annoyances that I wish browsers would actively mitigate, in no particular order: js-based redirects, blocking copy-paste, disabling text selection, hijacking the forward slash to open the website's own search function (I'm looking at you, Github), hijac…

In Firefox, shift+right-click brings up the browser context menu.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#292

Btw, at http://google.com , this is what they have for the search field:

Does anybody have a clue why it does not show up there? The Google team must have done something in order to circumvent what the Chrome team did. Horrible.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#293
post #251

Earlier quoted context omitted.

I've heard plenty of people on HN say password managers should ignore autocomplete=off and I agree with them. Because that setting is mostly applied by organisations like banks who incorrectly think they're making things more secure by doing so. IMHO there are cases where autocomplete=off should be respected, and other times when it shouldn't be - it's certainly not as simple as saying always do or always don't respe…

Well, all major browsers now ignore it on password fields so the browser ship has sailed on that one: > This is the behavior in Firefox (since version 38), Google Chrome (since 34), and Internet Explorer (since version 11). - MDN

I recently received a ticket from or security team to add "autocomplete=off" to all our password input fields.

I was pretty sure that it wouldn't do anything except make the security team feel better.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#294

Earlier quoted context omitted.

We recently had to go through a website project and disable autocomplete on all password fields after a security scan as part of a PCI compliance process. For autofill password it didn’t seem to have any effect in _any_ browser I tested in. How can it be used to thwart password managers?

Why would you need to disable autocomplete passwords for PCI compliance?

Because either the PCI standard says so, or the PCI consultant says so.

PCI compliance is about checking boxes, not weighing the options and making good choices.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#296
post #294

Earlier quoted context omitted.

Why would you need to disable autocomplete passwords for PCI compliance?

Because either the PCI standard says so, or the PCI consultant says so. PCI compliance is about checking boxes, not weighing the options and making good choices.

Exactly this. Some of the checks _are_ valuable. We found a couple of real issues and made good security improvements. But we also ticked off more than a few boxes that made no damn real sense.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#297

Earlier quoted context omitted.

>I can tell you that the higher management at Google does not dictate chromium changes as they are too technical for them. Tell that to the webRequest API that ablockers use. >As you said for the exceptions, Microsoft can maintain a fork, it's still order of magnitude more economic and smart than to constantly duplicate work in a redundant browser (firefox) Chrome is the redundant browser. Firefox was here first.

webRequest API Well maybe it's an exception, but they have technical reasons mostly. Webrequest v3 is not stable so wait and see. Chrome is the redundant browser. Firefox was here first. Well Chrome is based on khtml which is not that new but yeah Netscape navigator precede it. Indeed it would have been better if chrome was based on gecko (FF) at the time. But now Firefox can be thought of the redundant browser becau…

On that scenario we would become Chromium developers, exactly my initial premise.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#298
post #273

Earlier quoted context omitted.

Did you try using a first-letter of a location you commonly use in forms? Here is what mine looks like when I use 'm' (like OP): https://i.imgur.com/NlzVqhT.png and here's what it looks like when I enter 's': https://i.imgur.com/1u4Iy7S.png (actually, S does not autocomplete in the Swiss site)

does the escape key close the extra context menu?

Yeah! Good to know. Did the chrome UI make us aware of that shortcut at some point?

Re: Issue 914451: Autofill does not respect autocomplete="off"

#299
post #74

Earlier quoted context omitted.

Well, shortly you won't have a choice anymore. And there was a choice, back then alternatives like Opera, did actually ship their own engine.

We're not talking about choice for users . This is about choice for developers .

Likewise I had Netscape, Opera, IE on my development environment.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#300
post #226

Earlier quoted context omitted.

> That begs the question Offtopic, but no it doesn't [1]. [1] https://grammarist.com/rhetoric/begging-the-question-fallacy...

When a phrase is used the “wrong” way more often than the right way, it ceases to be wrong.

Idiocracy, defined.
Post reply on HN