3 ms·
We recently had to go through a website project and disable autocomplete on all password fields after a security scan as part of a PCI compliance process. For a
by cdubzzz 7y ago
We recently had to go through a website project and disable autocomplete on all password fields after a security scan as part of a PCI compliance process. For autofill password it didn’t seem to have any effect in _any_ browser I tested in. How can it be used to thwart password managers?
- driverdan 7y agoWhy would you need to disable autocomplete passwords for PCI compliance?
- toast0 7y agoBecause either the PCI standard says so, or the PCI consultant says so. PCI compliance is about checking boxes, not weighing the options and making good choices.
- cdubzzz 7y agoExactly this. Some of the checks _are_ valuable. We found a couple of real issues and made good security improvements. But we also ticked off more than a few boxes that made no damn real sense.