4 ms·

It causes spec-compliant password managers to not work. Unfortunately, disabling autocomplete for password fields is an often used form of security-theatre

by pilif 7y ago

techsupporter 7y ago
Combine that with sites attempting to block pasting in a "complex, secure" password and I start to see Google's point here, bad as I don't want to. How "auth" is handled, at almost every layer, seems about as badly broken as "security" in the U.S. banking system. Fortunately, Firefox gives me dom.event.clipboardevents.enabled so I at least need not worry about my workaround being broken.
tus88 7y ago
Ok, but how is that abuse? And if autocomplete=off is part of the html standard, how are the password managers spec compliant if they can't deal with it? Are people doing this just to annoy users who prefer password managers?
- Thorrez 7y ago
  >Are people doing this just to annoy users who prefer password managers? People are doing it because they don't understand password managers, and think blocking them makes people more secure. They believe that if a password is in a manager, that password is less secure than if that password was purely in the user's head.
  - londons_explore 7y ago
    If a bug in the password manager leaked the password to your bank to a third party, many users wouldn't want to pay for any associated costs/expenses when a bad guy steals their money. Yet the bank also doesn't want to take on security audits for code entirely outside their control.
    - pas 7y ago
      Then banks should recommend a good password manager. It's on them to make their users happy after all. One part of that is a proper risk analysis. Password reuse and weak passwords are much bigger risks than a rouge autocompleter.
    - Thorrez 7y ago
      I consider that similar to a bug in the browser or the operating system. Should the bank require that I only use specific browsers or operating systems? In fact any program I install on my computer could have a vulnerability, or be malicious and thus lead to my password being stolen. Should the bank require that I not install any programs except ones they specifically permit? The bank should also consider which is more frequent: user account compromises due to weak/reused passwords, or user account compromises due to password manager bugs.
tmd83 7y ago
Here's the tricky thing and I don't have a solution that doesn't get abused. I hate that lots of bank do this but I also have a use case for password autocomplete=off. We operate in an industry where shared computer access is very common and the risk of users saving password in browser is real and too high. As I said don't know what the answer is. I definitely want someone using password manager be able to use them. Using a password manager is a conscious choice with setups involved. Browser's default autocomplete is often not. I don't know how to separate these two out.
- epochwolf 7y ago
  Isn’t it on the people administering those systems to disable autofill on their side?
  - tmd83 7y ago
    In theory it is. But for most customers (who are small) there's almost no IT department and the average computer literacy is lower than you might think (though improving) so the risk is there. Except for that situation I would happily leave them autofill/save password.
- al2o3cr 7y ago
  You could, I dunno, use the tools specifically provided to disable saving passwords in environments where that's undesirable: https://thycotic.com/company/blog/2013/09/09/securing-web-browsers-through-group-policy/ https://thycotic.com/company/blog/2013/09/09/securing-web-br...
- pas 7y ago
  kiosk mode? Firefox has a great extension for this.
rndgermandude 7y ago
Then only ignore autocomplete=off for forms that have password fields. Sure, stupid devs can still work around that too, but so can they work around the current ingore-always behavior.

It causes spec-compliant password managers to not work. Unfortunately, disabling autocomplete for password fields is an often used form of security-theatre

by pilif 7y ago

It causes spec-compliant password managers to not work. Unfortunately, disabling autocomplete for password fields is an often used form of security-theatre

techsupporter 7y ago

Combine that with sites attempting to block pasting in a "complex, secure" password and I start to see Google's point here, bad as I don't want to. How "auth" is handled, at almost every layer, seems about as badly broken as "security" in the U.S. banking system. Fortunately, Firefox gives me dom.event.clipboardevents.enabled so I at least need not worry about my workaround being broken.

tus88 7y ago

Ok, but how is that abuse? And if autocomplete=off is part of the html standard, how are the password managers spec compliant if they can't deal with it? Are people doing this just to annoy users who prefer password managers?

Thorrez 7y ago
>Are people doing this just to annoy users who prefer password managers? People are doing it because they don't understand password managers, and think blocking them makes people more secure. They believe that if a password is in a manager, that password is less secure than if that password was purely in the user's head.
- londons_explore 7y ago
  If a bug in the password manager leaked the password to your bank to a third party, many users wouldn't want to pay for any associated costs/expenses when a bad guy steals their money. Yet the bank also doesn't want to take on security audits for code entirely outside their control.
  - pas 7y ago
    Then banks should recommend a good password manager. It's on them to make their users happy after all. One part of that is a proper risk analysis. Password reuse and weak passwords are much bigger risks than a rouge autocompleter.
  - Thorrez 7y ago
    I consider that similar to a bug in the browser or the operating system. Should the bank require that I only use specific browsers or operating systems? In fact any program I install on my computer could have a vulnerability, or be malicious and thus lead to my password being stolen. Should the bank require that I not install any programs except ones they specifically permit? The bank should also consider which is more frequent: user account compromises due to weak/reused passwords, or user account compromises due to password manager bugs.

tmd83 7y ago

Here's the tricky thing and I don't have a solution that doesn't get abused. I hate that lots of bank do this but I also have a use case for password autocomplete=off. We operate in an industry where shared computer access is very common and the risk of users saving password in browser is real and too high. As I said don't know what the answer is. I definitely want someone using password manager be able to use them. Using a password manager is a conscious choice with setups involved. Browser's default autocomplete is often not. I don't know how to separate these two out.

epochwolf 7y ago
Isn’t it on the people administering those systems to disable autofill on their side?
- tmd83 7y ago
  In theory it is. But for most customers (who are small) there's almost no IT department and the average computer literacy is lower than you might think (though improving) so the risk is there. Except for that situation I would happily leave them autofill/save password.
al2o3cr 7y ago
You could, I dunno, use the tools specifically provided to disable saving passwords in environments where that's undesirable: https://thycotic.com/company/blog/2013/09/09/securing-web-browsers-through-group-policy/ https://thycotic.com/company/blog/2013/09/09/securing-web-br...
pas 7y ago
kiosk mode? Firefox has a great extension for this.

rndgermandude 7y ago

Then only ignore autocomplete=off for forms that have password fields. Sure, stupid devs can still work around that too, but so can they work around the current ingore-always behavior.