8 ms·

Good. It's my browser. I get to turn its features on and off, not you. And that goes double on my phone. As a compromise, I'd accept a prompt like: +----

• taf2 10y ago
  99% of the time I agree but imagine for a second a user management system that lets an administrator edit other users profiles and a browser that decides to autocomplete the email fields in the form or name etc... Better hope auto save is not a thing... Of course when it comes to buying things online give me my autocomplete or I hate you - love your recommendation for a browser prompt!
  • iamdave 10y ago
    imagine for a second a user management system that lets an administrator edit other users profiles Just my $0.02, and this might be taking us out of the scope of discussion (maybe not?) but I can't think of a good business reason why an administrator needs to control whether or not the end user can use a function like autocomplete. That seems like micromanaged minutiae that will annoy my users more than help them if it's something they rely on for data entry. And if that's the case...why bother touching it in the first place? Training/security policy that says "Be mindful of how you use this feature" to avoid any awkward NDA/HR situations? Sure, absolutely 100%. Curious what others think on this?
    • jroblak 10y ago
      You've completely missed the point of the comment. Your parent was describing a system where an Administrator edits other users' data. If that Administrator is using Chrome while editing a user, then there is no way to disable autocomplete, and the browser may fill the user's form fields with the Administrator's information resulting in bad data.
      • iamdave 10y ago
        I read "edit users profiles" to mean their Chrome profile, so my mistake in misreading that. (That said though, doesn't Autocomplete in chrome only work if you select the text in the drop down and hit enter/tab? For an address field, for example if you type "123" and the box appears to select "123 Maple Street", can't you just bypass that entirely by continuing to type and not clicking on the suggestion?)
        • wmil 10y ago
          If you allow it to remember your login credentials it will autofill any input that it thinks is a login / password. That leads to some random behaviour.
          • iamdave 10y ago
            That leads to some random behaviour. Elaborate? What is the impact of this random behavior for the-in the case of the analogy before us-an administrator? Doesn't Chrome's autocomplete, in the case of credentials know which credential belongs to what password? If an admin goes to log into gmail on an end user machine, and enters his email address, why would the user's password pop into the password field? I'm afraid I don't understand your counterpoint.
            • grey-area 10y ago
              The admin visits a page to edit a normal user on their website, which contains fields like email/password etc for that other user. Chrome autocompletes the admin user's password and email in the form fields without user interaction. There was no mechanism to tell chrome not to do this if autocomplete=off is ignored, but you can set autocomplete to an arbitrary value (say =nope not =off as in spec) and it will not autocomplete. I've seen this on real sites and had users complain about it, it is a very real issue, and unfortunately not all admin users are savvy enough to turn off autocomplete in just one instance, when they use it all the time elsewhere (even on the same website). It's nice if the website can somehow fix this by saying they really don't want autocomplete on a form to edit other users. Personally I think the browser should give the user control, but autocomplete should not be the default if the website requests it to be off, it should be available on right click or with some easily accessible option. This should satisfy everyone and avoid situations like the one described above where the user sees arbitrary and incorrect values being filled in a form which is not related to their user and is not a login form.
    • betenoire 10y ago
      We'd probably disagree on what determines a good reason. I've encountered plenty of admins that need/want god-like permissions in the app they are paying me to write.
    • EpicEng 10y ago
      >but I can't think of a good business reason why an administrator needs to control whether or not the end user can use a function like autocomplete I work in biotech; FDA regulated medical devices and diagnostic tests. Allowing autocomplete for forms which log you into an application which is used to sign out diagnostic reports is going to cost us in an audit. I realize this is not a typical case, but there you have it.
• yborg 10y ago
  It's Google's browser. This is your mistake for using Google's browser if you don't agree with what Google wants their browser to do.
  • Myrth 10y ago
    Exactly. I have no idea why people blamed IE for not following standards. It was totally all of its users' fault for using it.
    • lucasmullens 10y ago
      People have the right to blame something for doing something wrong. If McDonald's burns my burger, I'm going to blame them, even though I can choose to not go there.
      • deleted 10y ago
        [deleted]
      • Natsu 10y ago
        It would be a rather odd turn of events if they burned your burger without you ever visiting the place, though. I fear that their approach is likely to just create an arms race, though. The same people who, for whatever ill-considered reasons, disabled it once will do so again. I'd rather control it as a user. Because, honestly, I only ever see this used to keep me from having my password manager manage secure passwords, which is just obnoxious. These are usually the same sites that ban things like spaces in passwords, or cap you at 10 characters.
  • LionessLover 10y ago
    Uhm.... your reply makes no sense - what he says is in support of the Chrome decision.
• jobead 10y ago
  If you want to "turn it's features on and off", then why does the Chromium team's stance of "extensions are the standard way to enable custom behavior"[0] not apply here??? This is a classic unfortunate case of using data from the masses to drive a bad design choice because it increases "usage" along an arbitrary axis. [0] https://news.ycombinator.com/item?id=11729287 https://news.ycombinator.com/item?id=11729287
  • comex 10y ago
    In the phrase you quoted, "custom" means "different from the default". It's about a choice between building customization into the browser (in the form of preferences) and relying on extensions to provide it. And it does apply here: there is no preference to honor autocomplete=off. If you want your Chrome instance to do so... find an extension. (Though, since my quick search of the Chrome Web Store found a lot of [presumably no longer necessary] extensions to disable autocomplete=off but none to do the opposite, you might have to write it yourself. It should suffice to change "off" to an unrecognized string, as mentioned in the last comment on the issue report.)
    • tracker1 10y ago
      Given the autocomplete detail tokens[1] - my first thought was autocomplete="section-disabled disabled" Or something similar. [1] https://html.spec.whatwg.org/multipage/forms.html#autofill-detail-tokens https://html.spec.whatwg.org/multipage/forms.html#autofill-d...
  • forgottenpass 10y ago
    The Chromium team's stance of "extensions [...]" is better understood as: "get the fuck off my lawn."
• _lce0 10y ago
  I agree. And nothing prevents us from dropping, on ~/.js setTimeout(() => { Array.from( document.querySelectorAll('[autocomplete]') ).forEach( el => el.removeAttribute('autocomplete') ); }, 250);
  • jessedhillon 10y ago
    Is ~/.js something I should know about? Somewhere to add snippets of Javascript which are run unconditionally by Chrome on any page load?
    • strictnein 10y ago
      I'm just praying it's not some new lodash like library I have to learn.
    • qwyxzy 10y ago
      https://github.com/defunkt/dotjs https://github.com/defunkt/dotjs
  • nness 10y ago
    The Dotjs extension is no longer maintained, just for those looking at this and wondering if it's worthwhile.
• dasil003 10y ago
  Take it up with the standards body then. Presumably this came about because some framework or something started including bad default attributes, and then Chrome responds by ignoring the meaning of the specification in order to "improve UX". But in the end what happens is that the specification becomes meaningless and we're back to the browser wars where you have no way of knowing how anything works except a continuous testing process to vet the veracity of the spec for any browser you are targeting, and of course this is subject to change on a whim by Google. Will it improve the UX? Maybe... if Google is correct in its unilateral assumptions. But one thing for sure is that as a developer this costs you time, and it hurts the most if you are a well-intentioned developer who is trying to make the correct choice for your specific use case.
  • dragonwriter 10y ago
    > Take it up with the standards body then. But, in the standard, the autocomplete attribute is a hint to the user agent, not an authoritative direction. [0] The people who want to make it an authoritative direction ought, as you say, to take it up with the standards body. [0] https://html.spec.whatwg.org/multipage/forms.html#autofill https://html.spec.whatwg.org/multipage/forms.html#autofill : "User agents sometimes have features for helping users fill forms in, for example prefilling the user's address based on earlier user input. The autocomplete content attribute can be used to hint to the user agent how to, or indeed whether to, provide such a feature." (emphasis added)
    • nix0n 10y ago
      Later that same page says : "When an element's autofill field name is "off", the user agent should not remember the control's data, and should not offer past values to the user." (The word "should" has its own meaning in RFCs generally http://www.ietf.org/rfc/rfc2119.txt http://www.ietf.org/rfc/rfc2119.txt and in whatwg specifically https://wiki.whatwg.org/wiki/Specs/howto#Content https://wiki.whatwg.org/wiki/Specs/howto#Content)
      • dragonwriter 10y ago
• draw_down 10y ago
  Sometimes it's better to turn off for usability reasons, and the browser doesn't have a clue about when that's the case. For example when the page has its own autocompleter, which has more information available to it than the browser does. A good example is the branch-switching widget on Github's repo page. Browser autocomplete is a major pain in the ass when trying to use this widget. The page can load all the branch names itself, but your dumbass browser is "helpfully" autocompleting a bunch of branch names that probably don't even exist anymore, or exist in other repos. Gee, thanks soooo much.
  • chrishacken 10y ago
    " For example when the page has its own autocompleter" Wouldn't that just override whatever values Chrome throws in there anyway? (If you're using JS.)
    • draw_down 10y ago
      No.
  • jasonlotito 10y ago
    There are ways to resolve those situations properly as explained in the link being discussed.
    • draw_down 10y ago
      So you defeat the autocomplete by messing with attributes in a slightly different way, and we've just gone in a circle. Great job everybody.
      • mikeash 10y ago
        That's pretty much the story of the web from day one, and I'm not sure if it can actually be avoided. The incentives and desires of the content producers, browser makers, and users are all too different.
  • 10y ago
• michaelmior 10y ago
  I could argue that it's my website and I get to decide what features I want to be usable. And if you don't like that, then go visit someone else's site. (This is not actually my personal stance, just playing devil's advocate.)
  • itp 10y ago
    Except that on a very real level, a website is a collection of resources along with instructions about how to assemble them. This is like getting upset at someone for putting together a Lego set "wrong."
    • bad_user 10y ago
      Legos are specifically designed such that the instructions are optional. The Lego Group wants it that way. Funny you mention them, because they've been suing for trademark and copyright infringement for years. And this is why we can't have nice things. Also playing devil's advocate, but there are days in which I think the DRM proponents actually have a point. When all of your digital devices will be DRM enabled and controlled by means of all sorts of trusted computing techniques, when you'll no longer own or be able to tweak anything, when VLC and Firefox won't be able to play your media anymore, when the police will knock on your door because you downloaded tcpdump, remember this moment.
  • tajen 10y ago
    Curious to see whether websites will start using DRM features for this purpose. Also, as long as changing the User-Agent header is recognized by a jury as impersonation, I can imagine that some country with retarded lawmakers [1] could require that browsers display the website the way the website owner wanted it. [1] a.k.a. where copyright owners are allowed many things over the citizen
  • raldi 10y ago
    You could argue that, but the user who owns the web browser has all the power in this situation. It's an arms race the website operator cannot win.
  • 10y ago
• deleted 10y ago
  [deleted]
• harikb 10y ago
  I agree. I always hated sites that disable Paste, disable right-click or whatever.
  • yoo1I 10y ago
    Coincidentally, Google Docs does that. It disables right-click for copy/paste and prompts you in a popup to install some stupid app to re-enable this functionality. ... or you know CTRL-C/CTRL-V, cause there isn't really a good reason to prevent you pasting with a mouse. I really don't get that
    • m741 10y ago
      Google Docs did this for a specific reason. Browsers restrict access to the clipboard on general user actions (like click, right click, etc). On the other hand, if you use ctrl+C or ctrl+V, the website gets access to the clipboard, because it's a JS clipboard event. So those work in Docs. Think about it - do you want any website to just read everything off your clipboard? Docs overrides right click because there's things you'd naturally want to do in a word processor with right click (format, link, comment, etc). Because docs shows a custom menu on right click, the browser will not expose the default menu, and without the default menu, there's no JS copy/paste event. Browser extensions have more access, and that's why a browser extension re-enables the functionality. So it was a design choice: the Docs team decided that giving users all these other right click actions was more important than allowing the user to right click to copy/paste without an extension (since most people use the keyboard shortcuts anyway).
      • Matt3o12_ 10y ago
        Good points, though, I don't agree with "most people use the keyboard shortcuts anyway". Most not-so-tech-savvy users I know, don't know keyboard shortcuts, find them hard to remember, clumsy and slow (at least until they learn how to really use them). I think that googles decision was valid and the best compromise they could have made. I really don't see a way how they could achieve both, without compromising the user's privacy in a manner that doesn't require a specific browser or extension.
• deleted 10y ago
  [deleted]
• wmil 10y ago
  Counter argument: Chrome doesn't ask you, and they don't provide any way for you to respect the standard behaviour. If it breaks websites you use then your only option is to completely disable autocomplete.
  • tracker1 10y ago
    I find that there's far more times I'd rather have autocomplete than have it actually disabled... I hate when sites force it disabled, when there's no real reason to, and as a user it's irritating. The only time I find autofill annoying is sometimes (on my phone) lastpass will fly open at inopportune times, when entering something in a password field that's not really a password, etc.
• tacone 10y ago
  The problem is simple: what is a login form? Browsers detect the login form from the presence of password fields and sometimes an email field. If you ever have an admin form were you can change the password of a user, you will get the autocomplete everytime, no matter what you do. You have to resort to JS. Also there are situations where you just don't want to give your users the choice (bank apps etc).
  • timv 10y ago
    This! I have previously wasted so much time working around this browser behaviour. The trick I use now is to add in a hidden (via CSS) pair on inputs earlier on the page, that do nothing. The browser fills those in, and leaves the real password admin fields empty.
    • zimpenfish 10y ago
      I might be missing something subtle or obvious but can't you just give the inputs different names? Is it such a trauma to handle that case in the backend? e.g. <input name='admin-user'><input name='admin-pass'>? (Now if Chrome is auto{fill,complet}ing those with usernames + passwords, that's definitely a disastrous bug.)
      • timv 10y ago
        Now if Chrome is auto{fill,complet}ing those with usernames + passwords, that's definitely a disastrous bug You say "bug", they say "works as designed".
    • tacone 10y ago
      Interesting trick.
• tsieling 10y ago
  Cool, we've created several forms re-used in the same browser for different people to gather public information. We now know never to use Chrome, since its developer assumptions trump our actual design needs.
  • groby_b 10y ago
    Since you have direct control of the browser, the simplest answer would be to go to settings and turn off autocomplete entirely.
• philliphaydon 10y ago
  Autocomplete in chrome is one of its worst features. From a user and developer perspective.
• MildlySerious 10y ago
  Flash. Cookies. Location. Autocomplete? It's good to have a choice, but having to click my way through a dozen of these popups and fixed toolbars before having the content on my screen I desire is not the future I want.
• aftbit 10y ago
  Does anyone really still feel that Chrom(ium) is "your browser" anymore? It is just Google's way to exert their dominance on web standards and make paternal and self-serving decisions, all in the name of helping the "average" user. As for extensions to allow customization, where's the extension that gives me back page actions (icons in the URL bar)? I know all the folks at Google are using shiny MBPs with billion-pixel displays, but I don't really like having 10 icons on the right of my URL bar just to show various status pages. :(
  • raldi 10y ago
    You can drag the right edge of your URL bar left and right to show or hide those icons.