4 ms·

> It's not protecting your interests, it's protecting Google's interests. But you can always install (or develop) another browser that might do this job better

> It's not protecting your interests, it's protecting Google's interests. But you can always install (or develop) another browser that might do this job better for you. > If it was protecting your interests, it would be a toggleable setting that defaults to normalized behavior. The problem with this view is that the vast majority of end users do not want, and in fact will never know about or use a new setting, and so the when doesn't move forward. This is the opt-in problem that Google is talking about. In politics, an analogy is called public choice theory.

pas 9y ago
Users don't use thousands of sites. If a site misbehaves and users want autofill on it, they should be able to override autocomplete=off for that site. Google could even make an extension for this to allow users to gather and share a list of sites that behave in a user unfriendly way. But of course, it was much easier to fuck up half of the Web. Public choice and mandates are great for things that require cooperation and agreement against race to the bottom (like tax havens), not against autocomplete fucking off.
- Tyr42 9y ago
  > If a site misbehaves and users want autofill on it, they should be able to override autocomplete=off for that site. How? What do you imagine?
  - winkeltripel 9y ago
    We don't need to imagine. Lots of sites abused autofill in order to prevent password management. That's why autocomplete=off gets stomped.
  - another-dave 9y ago
    This website has turned off auto-complete, as they believe it may not work effectively for their forms. * Turn on anyway * Leave disabled for this form = Remember my choice for this website
  - mcv 9y ago
    With the same yellow bar at the top that they use for other issues. Tell them what the site is doing and ask whether they want to allow or block that, and whether to do that for all sites or only this one.
- briandear 9y ago
  I have a site that deals with HIPPA protected information. I absolutely don’t want autofill, especially for sign in information. Chrome makes that impossible and just ignores the code.
  - bshacklett 9y ago
    Could you explain the downside of allowing auto-fill for sign-in information here? I understand that security is a concern, but I don't see how allowing a password manager to handle sign-ins would be harmful.
    - TJSomething 9y ago
      In a medical setting, most computers are public. Sharing passwords is a HIPAA violation, because HIPAA requires a complete, accurate log of everyone who has looked at or modified a medical record. My guess is that many medical computers aren't well administrated and leave autofill on, which can easily cause accidental HIPAA violations.
      - bshacklett 9y ago
        Disabling autofill seems like the wrong way to handle the problem, though. Autofill does not necessarily mean that passwords are being shared; it just means that the user isn't typing them in. Strong policies on the machines in question and ensuring that users aren't sharing each others environments seems like a considerably more complete solution to me. This can be facilitated by tools like https://www.imprivata.com/single-sign-on-sso https://www.imprivata.com/single-sign-on-sso. Ironically enough, disabling autofill may actually prevent this tool from providing some of the benefits it's intended to provide.
        ysavir 9y ago
        While I agree that autofill on its own is not a complete solution to GP's scenario, it's certainly a potential point-of-failure, and I understand their need to eliminate as much risk as possible. While the most significant aspect to be improved is the security habits of the clients themselves, that doesn't mean that GP and their company should be prevented from doing what little they can just because Google wanted things to work their way.
- davidcbc 9y ago
  Do you have concrete examples of websites that are "fucked up" because of this?
walterstucco 9y ago
> The problem with this view is that the vast majority of end users do not want I'm a user. I want that. I'm probably not "a majority" but I fail to see how being assimilated to the majority without my consent, without even knowing it is happening, is "protecting my interests" What would you think of a restaurant that charges you 50% of the bill as tip because "the majority of the customers does that"?
- dwild 9y ago
  > What would you think of a restaurant that charges you 50% of the bill as tip because "the majority of the customers does that"? I don't know about you but when I go to the restaurant, I can't change the price of the items. If they set the tip for you, that's pretty much setting the price, isn't it?
  - walterstucco 9y ago
    > If they set the tip for you, that's pretty much setting the price, isn't it? I forgot HN is mostly an american place. Tip in most Europe is voluntary We don't force people to tip
defined 9y ago
IMO, breaking an established API with no reliable way to work around it is very bad. I have been bitten by this, and only now understand why. I will probably switch to Firefox.
- defined 9y ago
  Update: I switched to Firefox. Happy.

pas 9y ago

Users don't use thousands of sites. If a site misbehaves and users want autofill on it, they should be able to override autocomplete=off for that site. Google could even make an extension for this to allow users to gather and share a list of sites that behave in a user unfriendly way. But of course, it was much easier to fuck up half of the Web. Public choice and mandates are great for things that require cooperation and agreement against race to the bottom (like tax havens), not against autocomplete fucking off.

Tyr42 9y ago
> If a site misbehaves and users want autofill on it, they should be able to override autocomplete=off for that site. How? What do you imagine?
- winkeltripel 9y ago
  We don't need to imagine. Lots of sites abused autofill in order to prevent password management. That's why autocomplete=off gets stomped.
- another-dave 9y ago
  This website has turned off auto-complete, as they believe it may not work effectively for their forms. * Turn on anyway * Leave disabled for this form = Remember my choice for this website
- mcv 9y ago
  With the same yellow bar at the top that they use for other issues. Tell them what the site is doing and ask whether they want to allow or block that, and whether to do that for all sites or only this one.
briandear 9y ago
I have a site that deals with HIPPA protected information. I absolutely don’t want autofill, especially for sign in information. Chrome makes that impossible and just ignores the code.
- bshacklett 9y ago
  Could you explain the downside of allowing auto-fill for sign-in information here? I understand that security is a concern, but I don't see how allowing a password manager to handle sign-ins would be harmful.
  - TJSomething 9y ago
    In a medical setting, most computers are public. Sharing passwords is a HIPAA violation, because HIPAA requires a complete, accurate log of everyone who has looked at or modified a medical record. My guess is that many medical computers aren't well administrated and leave autofill on, which can easily cause accidental HIPAA violations.
    - bshacklett 9y ago
      Disabling autofill seems like the wrong way to handle the problem, though. Autofill does not necessarily mean that passwords are being shared; it just means that the user isn't typing them in. Strong policies on the machines in question and ensuring that users aren't sharing each others environments seems like a considerably more complete solution to me. This can be facilitated by tools like https://www.imprivata.com/single-sign-on-sso https://www.imprivata.com/single-sign-on-sso. Ironically enough, disabling autofill may actually prevent this tool from providing some of the benefits it's intended to provide.
      - ysavir 9y ago
        While I agree that autofill on its own is not a complete solution to GP's scenario, it's certainly a potential point-of-failure, and I understand their need to eliminate as much risk as possible. While the most significant aspect to be improved is the security habits of the clients themselves, that doesn't mean that GP and their company should be prevented from doing what little they can just because Google wanted things to work their way.
davidcbc 9y ago
Do you have concrete examples of websites that are "fucked up" because of this?

walterstucco 9y ago

> The problem with this view is that the vast majority of end users do not want I'm a user. I want that. I'm probably not "a majority" but I fail to see how being assimilated to the majority without my consent, without even knowing it is happening, is "protecting my interests" What would you think of a restaurant that charges you 50% of the bill as tip because "the majority of the customers does that"?

dwild 9y ago
> What would you think of a restaurant that charges you 50% of the bill as tip because "the majority of the customers does that"? I don't know about you but when I go to the restaurant, I can't change the price of the items. If they set the tip for you, that's pretty much setting the price, isn't it?
- walterstucco 9y ago
  > If they set the tip for you, that's pretty much setting the price, isn't it? I forgot HN is mostly an american place. Tip in most Europe is voluntary We don't force people to tip

defined 9y ago

IMO, breaking an established API with no reliable way to work around it is very bad. I have been bitten by this, and only now understand why. I will probably switch to Firefox.

defined 9y ago
Update: I switched to Firefox. Happy.