4 ms·

GP is explicitly not dismissing the above use cases, but merely the supposed justification of "the developer wants it" being enough. > I think we can all agree

• watwut 7y ago
  Should developer be able to make it impossible to close browser or open 100 new tabs? No. Should developer decide that fields are autocomplete off or green or show javascript warnings? Absolutely yes. If user wish to change that, users thing. The browser/google has no business to be mediator here, second guess application they know nothing about and manipulate it. The browser should be predictable, well specified and harmless. It should not force me to convert all ids into random strings just so that random data do not get prefilled in.
  • michaelt 7y ago
    I've heard plenty of people on HN say password managers should ignore autocomplete=off and I agree with them. Because that setting is mostly applied by organisations like banks who incorrectly think they're making things more secure by doing so. IMHO there are cases where autocomplete=off should be respected, and other times when it shouldn't be - it's certainly not as simple as saying always do or always don't respect it.
    • kalleboo 7y ago
      Password managers should ignore autocomplete=off in login screens, but not in administration screens where you’re editing other people’s credentials. IMO the distinction could be made to not automatically fill when the autocomplete=off but instead add a button to let the user initiate it
      • rhizome 7y ago
        >not in administration screens where you’re editing other people’s credentials <input type="password" name="other-users-password" id="other-users-password">...
        • kalleboo 7y ago
          That was recommended by Google 3 years ago, but there are a bunch of reports in the bug reporter thread that that doesn’t work now. And credentials go beyond passwords - names, usernames, ID numbers
    • Rapzid 7y ago
      Well, all major browsers now ignore it on password fields so the browser ship has sailed on that one: > This is the behavior in Firefox (since version 38), Google Chrome (since 34), and Internet Explorer (since version 11). - MDN
      • Osiris 7y ago
        I recently received a ticket from or security team to add "autocomplete=off" to all our password input fields. I was pretty sure that it wouldn't do anything except make the security team feel better.
  • AJ007 7y ago
    * should a developer be able to hijack browser shortcuts, no. Should a developer be able to disable right click functionality, no.