Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Issue 914451: Autofill does not respect autocomplete="off"

bugs.chromium.org

Post reply on HN
Print view View original

81–90 of 383 posts

Re: Issue 914451: Autofill does not respect autocomplete="off"

#81

Post by StavrosK »

TekMol wrote: post #40

I guess this will lead to a horrible coding style where instead of having this in the form: We will see stuff like this: Where developers use some type of abstraction that generates a random id for each field and then assigns it to the original value server side or in javascript. Just like they already randomise asset filenames to avoid caching.

Your comment about randomizing filenames got me thinking. It would be great if we could add a cache key to the HTML element, that way we could cache everything forever with the same filenames and still invalidate things by just making the key being the SHA of the deploy. Too bad that's not a thing.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#82

Post by watwut »

carstenhag wrote: post #41

As I had already commented on the issue, it completely breaks Germany's main train ticket selling website: https://i.imgur.com/BjYTgSn.png They have tagged the field as autocomplete=off but Chrome just doesn't care. Also see this linked issue where they collected valid use cases for autocomplete=off. They just seem to ignore 452 use cases (I can't comment on the quality of them, I did not read any). https://bugs.chro…

Imo, valid use case for autocomplete=off is "the developer of webapp wants it".

Literally that and nothing more.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#83

Post by jstanley »

StavrosK wrote: post #81
TekMol wrote: post #40

I guess this will lead to a horrible coding style where instead of having this in the form: We will see stuff like this: Where developers use some type of abstraction that generates a random id for each field and then assigns it to the original value server side or in javascript. Just like they already randomise asset filenames to avoid caching.

Your comment about randomizing filenames got me thinking. It would be great if we could add a cache key to the HTML element, that way we could cache everything forever with the same filenames and still invalidate things by just making the key being the SHA of the deploy. Too bad that's not a thing.

That is a thing already!

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Re: Issue 914451: Autofill does not respect autocomplete="off"

#84

Post by justicz »

Thorrez wrote: post #75
donatj wrote: post #64

Earlier quoted context omitted.

lol, years and years ago (like 2005) as an attempt at stopping XSS and CSRF attacks and bots I came up with a system that named all the inputs a salted MD5 of the intended name with the salt randomly generated then stored in the users server side session. It’s still a reasonably effective solution for CSRF, though there are much simpler options, but today’s bots largely have cookie jars so you will likely need a CAPT…

How would it stop XSS? Is it meant to stop attackers from getting JS execution on your site, or to mitigate the attackers' abilities after they have JS execution? I don't see how it would do either.

Maybe they mean CSRF? Then things make more sense since you can’t guess the field names cross-origin.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#85

Post by jussij »

shpx wrote: post #66
goatinaboat wrote: post #38

Overall, I still believe that neither of the extreme strategies ("always honor autocomplete=off" Is it “extreme” now for a computer to do what the user wants and not what a random Google employee wants? How does this differ from malware?

autocomplete=off is set by website developers, not users.

However the more important point made by the OP still remains which was some random Google employee chooses to ignore it.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#86

Post by nordsieck »

chris_wot wrote: post #61
andrewstuart wrote: post #48

The Chrome dev team have implemented autocomplete the way they think it should work, not the way web developers want. You cannot switch off Chrome's handling of autocomplete, thus any other autocomplete implementation will be overwritten by Chrome's handling. Chrome team feel they know best.

They are becoming the Gnome of browsers. The Chrome dev team seem to be getting more and more user hostile.

> They are becoming the Gnome of browsers.

What they're becoming is ie6.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#87

Post by ss3000 »

Setting aside the merits/lack-thereof of this particular decision, Chromium ignoring established web standards like this is especially dangerous as we're trending towards a world where 1) Chromium itself powers the most popular browser in the world by an increasingly unhealthy margin, and 2) even competing browsers are increasingly becoming skins on top of Chromium.

We are becoming more and more reliant on the developers of Chromium to be steadfast stewards of the standardization process. Their massive influence means that any deviation from actual web standards on their part will inevitably create a new and conflicting de-facto standard that will create decades of lasting damage and irreversible tech debt for the entire web (eventually leading to a repeat of the IE6 dark ages).

Decisions like this demonstrate an utter disregard for the crucial role Chromium plays in the web standardization process, and jeopardizes the entire ecosystem.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#88

Post by xg15 »

TekMol wrote: post #40

I guess this will lead to a horrible coding style where instead of having this in the form: We will see stuff like this: Where developers use some type of abstraction that generates a random id for each field and then assigns it to the original value server side or in javascript. Just like they already randomise asset filenames to avoid caching.

> Just like they already randomise asset filenames to avoid caching.

But why? Isn't the whole point of caching to improve delivery if static assets?

Did they run into staleness problems? Then why not use if-modified-since/if-none-match?

Re: Issue 914451: Autofill does not respect autocomplete="off"

#89

Post by andrewstuart »

The weird thing is that there's other teams within Google who offer autocomplete libraries that simply don't work because Chrome overlays it's own autocomplete on top.

The maps team seems to have given up on trying to resolve that.

Chrome team have made a judgement that autocomplete is required and no-one - not even other teams within Google are allowed to override that functionality.

It's weird.

Re: Issue 914451: Autofill does not respect autocomplete="off"

#90

Post by Nitramp »

doctorpangloss wrote: post #43
jchw wrote: post #37

Because other people here are throwing in their frustrations, I will at least add that on the flip side I have been frustrated by sites that attempt to disable autofill for illegitimate reasons, like attempting to disallow password managers. I think I understand where this is coming from. On the other hand, I, too, have been bit by this at least once, in the past. I think it was easier to just disable it at that time…

Disabling autocomplete is so incredibly frustrating that I ran an extension in Safari to remove the off tag from sites. Of course I want to use KeyChain, the whole point is that touch based ID is more secure.

I have my own extension for Chrome that yanks the autocomplete attribute. I much rather deal with over eager completion than websites disabling it for silly reasons and pseudo security.
Post reply on HN