3 ms·

Isn't this a reaction to moronic use of autocomplete=off in a user-hostile way by various websites? In a similar vein to how abuses of disabling the back button

Isn't this a reaction to moronic use of autocomplete=off in a user-hostile way by various websites? In a similar vein to how abuses of disabling the back button, popups etc have led to defensive measures by browser vendors.

Bartweiss 9y ago
Sort of? Autocomplete=off is abused, certainly. It's commonly used to interrupt password manager functionality, in much the same way that copy/paste disabling is used on "repeat new password" fields. (As an aside: disabling autocomplete is a good idea, but only on the password manager level, not the website level. It's defense for user privacy, so employing it on well-meaning websites is worthless.) But it's not abused in the user-endangering manner that circular redirects and back button hijacking have been. (Specifically, to make scam sites hard to escape and easy to click into.) It's just an inconvenience to users, and honestly I'm not thrilled to see browsers override code for non-security reasons.
KeitIG 9y ago
You are right, but my personal problem here is autocomplete is automatically applied where it should not be. [1] [1] https://bugs.chromium.org/p/chromium/issues/detail?id=587466#c83 https://bugs.chromium.org/p/chromium/issues/detail?id=587466...
- akvadrako 9y ago
  There is no general solution; only the end-user is smart enough to know when autocomplete should be used, and asking them to specify it for every field is too much work. Personally, I installed a Safari plugin to ignore autocomplete=off because it was so annoying. So Chrome is doing what I want my browser to do.
  - WorldMaker 9y ago
    That's just it, maybe it is time to put it back into the hands of the end-user? You don't need to ask the user for every field, just an override for fields that have autocomplete=off. Add a simple mark for "Autocomplete was turned off on this site for this field" where clicking it overrides. You could add similar marks for fields with onpaste handlers to deactivate them.
Manishearth 9y ago
I'm one of the folks who pushed for autocomplete=off to be disabled for password fields because of abuse. Basically, browsers obeyed autocomplete=off to shut off password managers; and sites used this to shut off password managers for "idk lol security" reasons. This isn't what the autocomplete attribute was for in the first place; password managers have a different workflow and saving a password is prompted to the user, so we removed it. Password managers are not autocomplete features, basically. Disabling autocomplete=off on everything doesn't seem to be a good change. Would love to be proven wrong but I don't think there are any ways autocomplete=off can be abused besides the password manager thing, and it's not worked on password managers for years.
- pawelk 9y ago
  > "idk lol security" reasons. I hereby confess to being guilty of adding autocomplete="off" to a login form, because the client's corporate IT only cared about ticking all the boxes on a security conformance report. We have tried to fight this and some other rules (e.g. log the user out after 20mins), because this was quite a simple website, but the rules were strict like it was online banking at the very least. Now OWASP has changed their mind, but the damage has been done. > Since early 2014 most major browsers will override any use of autocomplete="off" with regards to password forms and as a result previous checks for this are not required and recommendations should not commonly be given for disabling this feature. [1] https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005) https://www.owasp.org/index.php/Testing_for_Vulnerable_Remem...
  - Manishearth 9y ago
    > because the client's corporate IT only cared about ticking all the boxes on a security conformance report. Yeah, I'm aware it used to be in conformance stuff (and probably still is in many cases). Super annoying when that happens :)
- jandrese 9y ago
  Corporate security requirements usually seem to come down to some committee sitting down and looking at every available option and demanding that they be configured to the most secure looking option, without regards to how much it actually improves security. This is a continual frustration of mine, when valuable diagnostic data is disabled for security reasons and then when stuff breaks I'm asked to go fix it blind. Sure you can have gigabytes of audit logs that are impossible to find anything in, but an error message that tells you that some system certificate expired is too much of a security vulnerability.

Bartweiss 9y ago

Sort of? Autocomplete=off is abused, certainly. It's commonly used to interrupt password manager functionality, in much the same way that copy/paste disabling is used on "repeat new password" fields. (As an aside: disabling autocomplete is a good idea, but only on the password manager level, not the website level. It's defense for user privacy, so employing it on well-meaning websites is worthless.) But it's not abused in the user-endangering manner that circular redirects and back button hijacking have been. (Specifically, to make scam sites hard to escape and easy to click into.) It's just an inconvenience to users, and honestly I'm not thrilled to see browsers override code for non-security reasons.

KeitIG 9y ago

You are right, but my personal problem here is autocomplete is automatically applied where it should not be. [1] [1] https://bugs.chromium.org/p/chromium/issues/detail?id=587466#c83 https://bugs.chromium.org/p/chromium/issues/detail?id=587466...

akvadrako 9y ago
There is no general solution; only the end-user is smart enough to know when autocomplete should be used, and asking them to specify it for every field is too much work. Personally, I installed a Safari plugin to ignore autocomplete=off because it was so annoying. So Chrome is doing what I want my browser to do.
- WorldMaker 9y ago
  That's just it, maybe it is time to put it back into the hands of the end-user? You don't need to ask the user for every field, just an override for fields that have autocomplete=off. Add a simple mark for "Autocomplete was turned off on this site for this field" where clicking it overrides. You could add similar marks for fields with onpaste handlers to deactivate them.

Manishearth 9y ago

I'm one of the folks who pushed for autocomplete=off to be disabled for password fields because of abuse. Basically, browsers obeyed autocomplete=off to shut off password managers; and sites used this to shut off password managers for "idk lol security" reasons. This isn't what the autocomplete attribute was for in the first place; password managers have a different workflow and saving a password is prompted to the user, so we removed it. Password managers are not autocomplete features, basically. Disabling autocomplete=off on everything doesn't seem to be a good change. Would love to be proven wrong but I don't think there are any ways autocomplete=off can be abused besides the password manager thing, and it's not worked on password managers for years.

pawelk 9y ago
> "idk lol security" reasons. I hereby confess to being guilty of adding autocomplete="off" to a login form, because the client's corporate IT only cared about ticking all the boxes on a security conformance report. We have tried to fight this and some other rules (e.g. log the user out after 20mins), because this was quite a simple website, but the rules were strict like it was online banking at the very least. Now OWASP has changed their mind, but the damage has been done. > Since early 2014 most major browsers will override any use of autocomplete="off" with regards to password forms and as a result previous checks for this are not required and recommendations should not commonly be given for disabling this feature. [1] https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005) https://www.owasp.org/index.php/Testing_for_Vulnerable_Remem...
- Manishearth 9y ago
  > because the client's corporate IT only cared about ticking all the boxes on a security conformance report. Yeah, I'm aware it used to be in conformance stuff (and probably still is in many cases). Super annoying when that happens :)
jandrese 9y ago
Corporate security requirements usually seem to come down to some committee sitting down and looking at every available option and demanding that they be configured to the most secure looking option, without regards to how much it actually improves security. This is a continual frustration of mine, when valuable diagnostic data is disabled for security reasons and then when stuff breaks I'm asked to go fix it blind. Sure you can have gigabytes of audit logs that are impossible to find anything in, but an error message that tells you that some system certificate expired is too much of a security vulnerability.