3 ms·

Regulatory compliance. I've worked on applications that had to go to great lengths to get the target browser platform to not do something like auto-complete aut

Regulatory compliance. I've worked on applications that had to go to great lengths to get the target browser platform to not do something like auto-complete authentication credentials. Philosophically-speaking some Web Platform developers think that it's more secure for the browser to autofill credentials from a keychain so that users can use better passwords and not be burdened with remember N-pseudo-random character sequences. Sounds good. Probably is good. Whether or not you agree with the above there are plenty of regulations in certain setting that require us to disallow client applications from auto-filling form fields. We have to battle with the Web Platform authors to fill this niche and work around everything they put in our way to stop us from doing our job. Awesome. Personally I thought feature detection was a smell and was glad to see it going the way of the do-do in the early aughts. Not so glad to see it making a come back.

izacus 9y ago
> Regulatory compliance. I've worked on applications that had to go to great lengths to get the target browser platform to not do something like auto-complete authentication credentials. If I had a penny for every time I've heard this excuse for really terrible unsafe practices just to find out that the developer deliberately misinterprets it to make its job easier... it be rather rich now.
TheCoelacanth 9y ago
Those regulations are bad and user-hostile. If they are making it impossible to fulfill them, they are doing the right thing for their users.
danaliv 9y ago
> Regulatory compliance. > there are plenty of regulations in certain setting that require us to disallow client applications from auto-filling form fields. And which regulations would those be, specifically?
- agentultra 9y ago
  If I recall in Part 11 compliance (which is how the FDA regulates software in the US) one is required to ensure that "Passwords are not remembered by [browsers] and applications." From an ISO/IEC/IEEE 29148 perspective the language might be "shall not remember passwords" which would imply a legally binding requirement for compliance purposes. This doesn't preclude applications from using autocomplete on form entry from password managers; just that the browser is not allowed to remember the entered password. However in practice I've seen most systems deploy their applications on a target platform that runs the browser in "kiosk" mode, which if I recall from the time, was an IE-only thing. In more modern times we're starting to see consumer-level tablets and devices enter the mix and I'm not even sure if those can be locked down into a multi-user/kiosk type mode. Regardless... the web is a difficult platform for this kind of stuff.
  - user5994461 9y ago
    Good thing that the NIST published updated recommendation on passwords, it supersedes all these previous regulations.
    - agentultra 9y ago
      I love the NIST. That's good to hear.
  - tinus_hn 9y ago
    If you want the browser to conform, you do control the browser. It isn't hard to set it up so it doesn't do autocomplete.

izacus 9y ago

> Regulatory compliance. I've worked on applications that had to go to great lengths to get the target browser platform to not do something like auto-complete authentication credentials. If I had a penny for every time I've heard this excuse for really terrible unsafe practices just to find out that the developer deliberately misinterprets it to make its job easier... it be rather rich now.

TheCoelacanth 9y ago

Those regulations are bad and user-hostile. If they are making it impossible to fulfill them, they are doing the right thing for their users.

danaliv 9y ago

> Regulatory compliance. > there are plenty of regulations in certain setting that require us to disallow client applications from auto-filling form fields. And which regulations would those be, specifically?

agentultra 9y ago
If I recall in Part 11 compliance (which is how the FDA regulates software in the US) one is required to ensure that "Passwords are not remembered by [browsers] and applications." From an ISO/IEC/IEEE 29148 perspective the language might be "shall not remember passwords" which would imply a legally binding requirement for compliance purposes. This doesn't preclude applications from using autocomplete on form entry from password managers; just that the browser is not allowed to remember the entered password. However in practice I've seen most systems deploy their applications on a target platform that runs the browser in "kiosk" mode, which if I recall from the time, was an IE-only thing. In more modern times we're starting to see consumer-level tablets and devices enter the mix and I'm not even sure if those can be locked down into a multi-user/kiosk type mode. Regardless... the web is a difficult platform for this kind of stuff.
- user5994461 9y ago
  Good thing that the NIST published updated recommendation on passwords, it supersedes all these previous regulations.
  - agentultra 9y ago
    I love the NIST. That's good to hear.
- tinus_hn 9y ago
  If you want the browser to conform, you do control the browser. It isn't hard to set it up so it doesn't do autocomplete.