5 ms·

imagine for a second a user management system that lets an administrator edit other users profiles Just my $0.02, and this might be taking us out of the scope

by iamdave 10y ago

imagine for a second a user management system that lets an administrator edit other users profiles Just my $0.02, and this might be taking us out of the scope of discussion (maybe not?) but I can't think of a good business reason why an administrator needs to control whether or not the end user can use a function like autocomplete. That seems like micromanaged minutiae that will annoy my users more than help them if it's something they rely on for data entry. And if that's the case...why bother touching it in the first place? Training/security policy that says "Be mindful of how you use this feature" to avoid any awkward NDA/HR situations? Sure, absolutely 100%. Curious what others think on this?

jroblak 10y ago
You've completely missed the point of the comment. Your parent was describing a system where an Administrator edits other users' data. If that Administrator is using Chrome while editing a user, then there is no way to disable autocomplete, and the browser may fill the user's form fields with the Administrator's information resulting in bad data.
- iamdave 10y ago
  I read "edit users profiles" to mean their Chrome profile, so my mistake in misreading that. (That said though, doesn't Autocomplete in chrome only work if you select the text in the drop down and hit enter/tab? For an address field, for example if you type "123" and the box appears to select "123 Maple Street", can't you just bypass that entirely by continuing to type and not clicking on the suggestion?)
  - wmil 10y ago
    If you allow it to remember your login credentials it will autofill any input that it thinks is a login / password. That leads to some random behaviour.
    - iamdave 10y ago
      That leads to some random behaviour. Elaborate? What is the impact of this random behavior for the-in the case of the analogy before us-an administrator? Doesn't Chrome's autocomplete, in the case of credentials know which credential belongs to what password? If an admin goes to log into gmail on an end user machine, and enters his email address, why would the user's password pop into the password field? I'm afraid I don't understand your counterpoint.
      - grey-area 10y ago
        The admin visits a page to edit a normal user on their website, which contains fields like email/password etc for that other user. Chrome autocompletes the admin user's password and email in the form fields without user interaction. There was no mechanism to tell chrome not to do this if autocomplete=off is ignored, but you can set autocomplete to an arbitrary value (say =nope not =off as in spec) and it will not autocomplete. I've seen this on real sites and had users complain about it, it is a very real issue, and unfortunately not all admin users are savvy enough to turn off autocomplete in just one instance, when they use it all the time elsewhere (even on the same website). It's nice if the website can somehow fix this by saying they really don't want autocomplete on a form to edit other users. Personally I think the browser should give the user control, but autocomplete should not be the default if the website requests it to be off, it should be available on right click or with some easily accessible option. This should satisfy everyone and avoid situations like the one described above where the user sees arbitrary and incorrect values being filled in a form which is not related to their user and is not a login form.
        iamdave 10y ago
        Let me ask a quick question because after reading your post I think a lightning bolt just struck my brain, and I went and read other comments: Have I been confusing autocomplete with auto-fill this whole time? Autofill where, let's say you shop on a site often, and you fill out one form field, select a saved entry and the rest of the form fills out?
    - 10y ago
- phil21 10y ago
  So don't use autocomplete? I still don't understand your point. It's not like leaving it on you are forced to use it. The client still has the choice. By turning it off you are removing choice. If your Administrator is too stupid to stop messing up and using autocomplete where it's not appropriate, then I think the correct action here is a pink slip. I generally agree you should try to keep users from shooting themselves in the foot, but not at the cost of hamstringing users who may want to use things differently.
  - jroblak 10y ago
    Yeah, fair, but it would be a better user experience if they didn't even have the option. This directly contradicts Google's position. You're statement is basically: Comment: User error Closed: Won't Fix
  - grey-area 10y ago
    autocomplete in chrome fills in the forms without user interaction, the user doesn't get the choice, they can only wipe the fields afterwards if they happen to notice.
betenoire 10y ago
We'd probably disagree on what determines a good reason. I've encountered plenty of admins that need/want god-like permissions in the app they are paying me to write.
EpicEng 10y ago
>but I can't think of a good business reason why an administrator needs to control whether or not the end user can use a function like autocomplete I work in biotech; FDA regulated medical devices and diagnostic tests. Allowing autocomplete for forms which log you into an application which is used to sign out diagnostic reports is going to cost us in an audit. I realize this is not a typical case, but there you have it.

by iamdave 10y ago

jroblak 10y ago

You've completely missed the point of the comment. Your parent was describing a system where an Administrator edits other users' data. If that Administrator is using Chrome while editing a user, then there is no way to disable autocomplete, and the browser may fill the user's form fields with the Administrator's information resulting in bad data.

iamdave 10y ago
I read "edit users profiles" to mean their Chrome profile, so my mistake in misreading that. (That said though, doesn't Autocomplete in chrome only work if you select the text in the drop down and hit enter/tab? For an address field, for example if you type "123" and the box appears to select "123 Maple Street", can't you just bypass that entirely by continuing to type and not clicking on the suggestion?)
- wmil 10y ago
  If you allow it to remember your login credentials it will autofill any input that it thinks is a login / password. That leads to some random behaviour.
  - iamdave 10y ago
    That leads to some random behaviour. Elaborate? What is the impact of this random behavior for the-in the case of the analogy before us-an administrator? Doesn't Chrome's autocomplete, in the case of credentials know which credential belongs to what password? If an admin goes to log into gmail on an end user machine, and enters his email address, why would the user's password pop into the password field? I'm afraid I don't understand your counterpoint.
    - grey-area 10y ago
      The admin visits a page to edit a normal user on their website, which contains fields like email/password etc for that other user. Chrome autocompletes the admin user's password and email in the form fields without user interaction. There was no mechanism to tell chrome not to do this if autocomplete=off is ignored, but you can set autocomplete to an arbitrary value (say =nope not =off as in spec) and it will not autocomplete. I've seen this on real sites and had users complain about it, it is a very real issue, and unfortunately not all admin users are savvy enough to turn off autocomplete in just one instance, when they use it all the time elsewhere (even on the same website). It's nice if the website can somehow fix this by saying they really don't want autocomplete on a form to edit other users. Personally I think the browser should give the user control, but autocomplete should not be the default if the website requests it to be off, it should be available on right click or with some easily accessible option. This should satisfy everyone and avoid situations like the one described above where the user sees arbitrary and incorrect values being filled in a form which is not related to their user and is not a login form.
      - iamdave 10y ago
        Let me ask a quick question because after reading your post I think a lightning bolt just struck my brain, and I went and read other comments: Have I been confusing autocomplete with auto-fill this whole time? Autofill where, let's say you shop on a site often, and you fill out one form field, select a saved entry and the rest of the form fills out?
  - 10y ago
phil21 10y ago
So don't use autocomplete? I still don't understand your point. It's not like leaving it on you are forced to use it. The client still has the choice. By turning it off you are removing choice. If your Administrator is too stupid to stop messing up and using autocomplete where it's not appropriate, then I think the correct action here is a pink slip. I generally agree you should try to keep users from shooting themselves in the foot, but not at the cost of hamstringing users who may want to use things differently.
- jroblak 10y ago
  Yeah, fair, but it would be a better user experience if they didn't even have the option. This directly contradicts Google's position. You're statement is basically: Comment: User error Closed: Won't Fix
- grey-area 10y ago
  autocomplete in chrome fills in the forms without user interaction, the user doesn't get the choice, they can only wipe the fields afterwards if they happen to notice.

betenoire 10y ago

We'd probably disagree on what determines a good reason. I've encountered plenty of admins that need/want god-like permissions in the app they are paying me to write.

EpicEng 10y ago

>but I can't think of a good business reason why an administrator needs to control whether or not the end user can use a function like autocomplete I work in biotech; FDA regulated medical devices and diagnostic tests. Allowing autocomplete for forms which log you into an application which is used to sign out diagnostic reports is going to cost us in an audit. I realize this is not a typical case, but there you have it.