Earlier quoted context omitted.
Unfortunately a few developers are morons who misuse features, and browser vendors try hard to work around them. Case in point, lots of websites used to put `autocomplete="off"` on password boxes, which breaks some password managers. IIRC that’s why Chrome (and other browsers) decided to sometimes ignore the `autocomplete` attribute in the first place. Of course that doesn’t justify ignoring it completely (just for p…
Now they need to ban intercepting/blocking `onpaste` in form fields.
Issue 914451: Autofill does not respect autocomplete="off"
301–310 of 383 posts
Re: Issue 914451: Autofill does not respect autocomplete="off"
#302Earlier quoted context omitted.
> That begs the question Offtopic, but no it doesn't [1]. [1] https://grammarist.com/rhetoric/begging-the-question-fallacy...
Technically correct, but look deeper: Why is this mistake prevalent? What are people trying to say that causes them to borrow (misuse) another phrase to express it? This indicates a "hole" in the language that is filled with the wrong item. Like a code review, do better than just saying "This line is wrong". Suggest an alternative. Especially one that flows naturally into the prose.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#303Earlier quoted context omitted.
I've heard plenty of people on HN say password managers should ignore autocomplete=off and I agree with them. Because that setting is mostly applied by organisations like banks who incorrectly think they're making things more secure by doing so. IMHO there are cases where autocomplete=off should be respected, and other times when it shouldn't be - it's certainly not as simple as saying always do or always don't respe…
Password managers should ignore autocomplete=off in login screens, but not in administration screens where you’re editing other people’s credentials. IMO the distinction could be made to not automatically fill when the autocomplete=off but instead add a button to let the user initiate it
...Re: Issue 914451: Autofill does not respect autocomplete="off"
#304Earlier quoted context omitted.
Um no. The user Name or ID is to identify. The password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security. > then a password or as you say "secret" is not required at all anymore Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfie etc. There's been dozens of ways to exploit over the years, many of which…
What is the compromise? What is insecure about me being me? Either we talk past each other not understanding each other's point, or I feel like you profoundly misunderstand the reason for people using username/password for authentication nowadays? With most things you need to authenticate to gain access. Authentication is only trying to solve one question - identifying that a person is who they say they are. If I wal…
In practice the computer is just getting a picture, which is semi-public information, and that's why the only thing you can rely on is that it's an identifier. It's not enough to authenticate when you really need security, only in more casual situations.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#305A few years ago, I left a $1000 tip at the restaurant up the street because Chrome filled out the tip field with my zip code (which thankfully merely defaulted to max $1000 instead). The tip field was off-screen, and the ordering software didn't have a confirmation screen, just a "we just charged your card $X amount" screen, which made my eyes boggle. EDIT: Looking at the original March 17th, 2015 bug, it would have…
Re: Issue 914451: Autofill does not respect autocomplete="off"
#306A few years ago, I left a $1000 tip at the restaurant up the street because Chrome filled out the tip field with my zip code (which thankfully merely defaulted to max $1000 instead). The tip field was off-screen, and the ordering software didn't have a confirmation screen, just a "we just charged your card $X amount" screen, which made my eyes boggle. EDIT: Looking at the original March 17th, 2015 bug, it would have…
Re: Issue 914451: Autofill does not respect autocomplete="off"
#307Earlier quoted context omitted.
That begs the question, at which point does autofill happen in an iframe? So I pay for an ad, and have a password, creditcard number, address etc. form in the background. Does the browser autofil, or does it autofill when the user starts to fill in a form in the foreground? Asking for a friend.
> That begs the question Offtopic, but no it doesn't [1]. [1] https://grammarist.com/rhetoric/begging-the-question-fallacy...
It's okay to say something with the same words as an idiom, without using the idiom.
The idiom was a mistake/mistranslation in the first place.
You're trying to push people away from the correct use of the word 'begs' into an incorrect use just because it's tradition.
Re: Issue 914451: Autofill does not respect autocomplete="off"
#308Earlier quoted context omitted.
Um no. The user Name or ID is to identify. The password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security. > then a password or as you say "secret" is not required at all anymore Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfie etc. There's been dozens of ways to exploit over the years, many of which…
What is the compromise? What is insecure about me being me? Either we talk past each other not understanding each other's point, or I feel like you profoundly misunderstand the reason for people using username/password for authentication nowadays? With most things you need to authenticate to gain access. Authentication is only trying to solve one question - identifying that a person is who they say they are. If I wal…
Identification is knowing which account to log in. dustinmoris, User123 or user124.
That alone is useless, as anyone who knows your name could log in. So we need to add security to authenticate you. To authenticate with reasonable certainty that the person accessing dustinmoris actually is Dustin Moris, at this moment willingly accessing their own account, willingly transferring £1m to NeedMoreTea. :)
Now, it's certainly true that biometrics are uniquely associated with you, but prove identity not authentication - bear with me here.
You leak DNA and fingerprints all over the place, constantly. Fingerprints have even been picked up from photos. That makes fingerprints surprisingly weak authentication. Face IDs have been fooled by video and photos. I'm not at all current on what the state of the art on FaceID hacking and devices is, so can't say more there. In a police interview they can place your thumb on the phone or wave phone under your face. Maybe borrow your thumb while you sleep to transfer that £1m. The bank will say you fully authenticated it, in their highly secure app, you will deny it.
In combining biometrics as identification and authentication we've compromised the system. It does not give certainty, or even especially high confidence. If motivated, anyone in your office could lift a print while you're out. Computer or phone says Dustin Moris is believed awake and accessing, but you're certainly not doing so willingly, nor can you resist if just a touch or look unlocks. In this context, your wife might easily pick up on whether you were willing in a police interview or not, the phone can't, because mere identification is the unlock.
With a password they have to persuade you to reveal it. It is very easy to not leak passwords accidentally on PostIts, and manage the complex with a password manager. The police can certainly beat it out of you, but most places are supposed to have rules against that. Many places actually honour those rules. A judge might question the bruises and missing teeth.
For a lot of people that's a fine distinction that doesn't matter, the convenience of it probably being you willingly unlocking the phone with your thumb is good enough. If security actually matters, it's not.
Sorry that got a bit long.