4 ms·

If you allow it to remember your login credentials it will autofill any input that it thinks is a login / password. That leads to some random behaviour.

by wmil 10y ago

iamdave 10y ago
That leads to some random behaviour. Elaborate? What is the impact of this random behavior for the-in the case of the analogy before us-an administrator? Doesn't Chrome's autocomplete, in the case of credentials know which credential belongs to what password? If an admin goes to log into gmail on an end user machine, and enters his email address, why would the user's password pop into the password field? I'm afraid I don't understand your counterpoint.
- grey-area 10y ago
  The admin visits a page to edit a normal user on their website, which contains fields like email/password etc for that other user. Chrome autocompletes the admin user's password and email in the form fields without user interaction. There was no mechanism to tell chrome not to do this if autocomplete=off is ignored, but you can set autocomplete to an arbitrary value (say =nope not =off as in spec) and it will not autocomplete. I've seen this on real sites and had users complain about it, it is a very real issue, and unfortunately not all admin users are savvy enough to turn off autocomplete in just one instance, when they use it all the time elsewhere (even on the same website). It's nice if the website can somehow fix this by saying they really don't want autocomplete on a form to edit other users. Personally I think the browser should give the user control, but autocomplete should not be the default if the website requests it to be off, it should be available on right click or with some easily accessible option. This should satisfy everyone and avoid situations like the one described above where the user sees arbitrary and incorrect values being filled in a form which is not related to their user and is not a login form.
  - iamdave 10y ago
    Let me ask a quick question because after reading your post I think a lightning bolt just struck my brain, and I went and read other comments: Have I been confusing autocomplete with auto-fill this whole time? Autofill where, let's say you shop on a site often, and you fill out one form field, select a saved entry and the rest of the form fills out?
takeda 10y ago
Chrome copied many features from Opera (the old Opera) I'm still surprised why they decided not to copy Wand (by default the browser does not populate any fields unless you click on the wand button or use keyboard shortcut). This works so much better than the behavior other browsers use.
- Hondor 10y ago
  What's more of a surprise is that there's a browser that has such a clumsy sounding feature as this "wand". Only power users are going to bother clicking a button just to help them fill in a form, or even know that's what the button does in the first place. That kind of manually activated feature seems to be completely against Chrome's style of minimalist UI, and for good reason, it will be one more confusing button for 90% of users to look at every day and be reminded that computers are complicated. I wouldn't bother trying to work out some weird button, I'd just manually type my details again and again into every form and feel annoyed that the browser isn't remembering them like other browsers do.
  - thwarted 10y ago
    Only power users are going to bother clicking a button just to help them fill in a form, or even know that's what the button does in the first place. This is an interesting observation. I never used the "wand" function in Opera because, partly, it's named in such a way as to not appeal to power users at all. The name "wand" says "do something magically". Agreed that "wand" doesn't indicate what it does, which is another reason to shy away from it. It's such a generic term as to be useless. Literally anything could be behind the "magic" operation.
    - takeda 10y ago
      I don't care about name, just the functionality. It could be called Secure Login, Autocomplete or other things. As long as it works correctly. Another thing I forgot to mention which is quite important. It works well when your password store is encrypted. It allows browser to ask you for your master password when you are trying to log in to the page, not when you happen to visit page that password is stored. This makes feasible to use configuration where the password is forgotten either immediatelly or after few minutes. Having encrypted password store in FF or Chrome and not storing the password all the time in memory is essentially unusable.
dragonwriter 10y ago
> That leads to some random behaviour. Mostly on sites that both have traditional login forms and use forms where other fields are mis-identified as password fields.

If you allow it to remember your login credentials it will autofill any input that it thinks is a login / password. That leads to some random behaviour.

by wmil 10y ago

If you allow it to remember your login credentials it will autofill any input that it thinks is a login / password. That leads to some random behaviour.

iamdave 10y ago

That leads to some random behaviour. Elaborate? What is the impact of this random behavior for the-in the case of the analogy before us-an administrator? Doesn't Chrome's autocomplete, in the case of credentials know which credential belongs to what password? If an admin goes to log into gmail on an end user machine, and enters his email address, why would the user's password pop into the password field? I'm afraid I don't understand your counterpoint.

grey-area 10y ago
The admin visits a page to edit a normal user on their website, which contains fields like email/password etc for that other user. Chrome autocompletes the admin user's password and email in the form fields without user interaction. There was no mechanism to tell chrome not to do this if autocomplete=off is ignored, but you can set autocomplete to an arbitrary value (say =nope not =off as in spec) and it will not autocomplete. I've seen this on real sites and had users complain about it, it is a very real issue, and unfortunately not all admin users are savvy enough to turn off autocomplete in just one instance, when they use it all the time elsewhere (even on the same website). It's nice if the website can somehow fix this by saying they really don't want autocomplete on a form to edit other users. Personally I think the browser should give the user control, but autocomplete should not be the default if the website requests it to be off, it should be available on right click or with some easily accessible option. This should satisfy everyone and avoid situations like the one described above where the user sees arbitrary and incorrect values being filled in a form which is not related to their user and is not a login form.
- iamdave 10y ago
  Let me ask a quick question because after reading your post I think a lightning bolt just struck my brain, and I went and read other comments: Have I been confusing autocomplete with auto-fill this whole time? Autofill where, let's say you shop on a site often, and you fill out one form field, select a saved entry and the rest of the form fills out?

takeda 10y ago

Chrome copied many features from Opera (the old Opera) I'm still surprised why they decided not to copy Wand (by default the browser does not populate any fields unless you click on the wand button or use keyboard shortcut). This works so much better than the behavior other browsers use.

Hondor 10y ago
What's more of a surprise is that there's a browser that has such a clumsy sounding feature as this "wand". Only power users are going to bother clicking a button just to help them fill in a form, or even know that's what the button does in the first place. That kind of manually activated feature seems to be completely against Chrome's style of minimalist UI, and for good reason, it will be one more confusing button for 90% of users to look at every day and be reminded that computers are complicated. I wouldn't bother trying to work out some weird button, I'd just manually type my details again and again into every form and feel annoyed that the browser isn't remembering them like other browsers do.
- thwarted 10y ago
  Only power users are going to bother clicking a button just to help them fill in a form, or even know that's what the button does in the first place. This is an interesting observation. I never used the "wand" function in Opera because, partly, it's named in such a way as to not appeal to power users at all. The name "wand" says "do something magically". Agreed that "wand" doesn't indicate what it does, which is another reason to shy away from it. It's such a generic term as to be useless. Literally anything could be behind the "magic" operation.
  - takeda 10y ago
    I don't care about name, just the functionality. It could be called Secure Login, Autocomplete or other things. As long as it works correctly. Another thing I forgot to mention which is quite important. It works well when your password store is encrypted. It allows browser to ask you for your master password when you are trying to log in to the page, not when you happen to visit page that password is stored. This makes feasible to use configuration where the password is forgotten either immediatelly or after few minutes. Having encrypted password store in FF or Chrome and not storing the password all the time in memory is essentially unusable.

dragonwriter 10y ago

> That leads to some random behaviour. Mostly on sites that both have traditional login forms and use forms where other fields are mis-identified as password fields.