7 ms·

This is exactly why I don't trust autofill. How many times has it passed along information you didn't intend, but without any obvious errors? Nobody knows.

monkin 6y ago
It’s not 1Password fault, but poor design and implementation. :-)
- neolog 6y ago
  1Password filled his card expiration date into the dollars field.
- smoldesu 6y ago
  If it's not 1Password's fault, who's is it? Obviously this story had a happy ending, so it's not a terribly big issue, but 1Password's client ultimately passed along the unwanted data.
  - freewilly1040 6y ago
    Clearly Substack. A UI that let's you specify 10X a price with no confirmation is (unintentionally in this case) malicious. This story could have easily been written about a user who fat fingered an extra 0 in the field.
    - ThePowerOfFuet 6y ago
      Unintentional malice? What?
  - monkin 6y ago
    This field should be clearly visible, even if 1Password would mistakenly input data in there.
- IncRnd 6y ago
  The poor design and implementation of 1Password, you mean.
  - chipotle_coyote 6y ago
    Speaking from personal experience -- over about six years at this point -- there are many, many web sites on the internets that 1Password's autofill works perfectly well on, and many others where it doesn't work perfectly but fails gracefully (or at least non-destructively). "Here is one site where it makes a mistake that could be catastrophic if you don't catch it" is just not a slam-dunk proof of 1Password being "poorly designed."
    - IncRnd 6y ago
      Ths is an appeal to authority. It is a shortcoming of the product's design for it to autofill a hidden field.
      - monkin 6y ago
        It’s visually hidden for us to see, not for 1Password auto fill mechanism.
        FDSGSG 6y ago
        Which is a problem in the 1Password autofill mechanism. Unless you believe that it should be filling forms which are hidden from humans?
        monkin 6y ago
        So you want 1Password to check CSS of the form before auto filling? The form itself isn’t hidden it’s styled to be flat. That’s the biggest problem of it.
        IncRnd 6y ago
        That exactly correct, which is why the fault is with 1Password's fill mechanism. A product has a bug when it does not produce output in-line with its stated purpose and process. Nobody would use a refrigerator that suddenly forgets to keep food cold when a carton of milk is placed on the shelf.
- readflaggedcomm 6y ago
  I don't trust autofill in what I use, either, Firefox or Keepass.
- nodesocket 6y ago
  Substack. A payment form should NOT allow you to enter any price in text fields, hidden or not.
  - gberger 6y ago
    Why not? It's an arbitrary donation amount.
mercantile 6y ago
Similar situation here. I use 1Password every day, but I only trust it to autofill simple login forms. Where something more complex is happening, I tend to copy information over field by field. This was trained into me over the years as I saw 1Password do too many things that were wrong or even sometimes scary. The nominal benefit you get sometimes when it works properly isn't worth it. And yes, web providers should give their web forms better names and better semantic information (e.g. `<input type="email">`), but even in 2021 it's just not always the case.
- CGamesPlay 6y ago
  > And yes, web providers should give their web forms better names and better semantic information (e.g. `<input type="email">`), but even in 2021 it's just not always the case. Well, there's no semantic input for "year" or "currency", so there's nothing the form designer could do to stop 1Password from picking the wrong field. This does kinda get to the root of the issue, which is that 1Password has to do a lot of "cognitive" analysis of the page to find the forms it wants which is simultaneously why it does better than most autofillers, and has worse false positives than most autofillers. I am also a happy 1Password user, and I'll happily let it prefill a complex form for me, but I've caught enough of its mistakes in the past that I will always manually double check before submitting. I could also see myself making a similar mistake as this user on this form though (since it's so simple I might not manually double check).
  - JimDabell 6y ago
    > Well, there's no semantic input for "year" or "currency", so there's nothing the form designer could do to stop 1Password from picking the wrong field. This is how you mark up the expiry year in a credit card form: <input autocomplete="cc-exp-year">
- r00fus 6y ago
  Mock me if you wish, but I tend to use 1Password for what it does best but use Apple’s Autofill for credit cards. It misses stuff sometimes but -fingers crossed - no issues with mis population into amount fields. I also use ApplePay or PayPal wherever possible to avoid data entry and reduce friction.
Waterluvian 6y ago
I once auto filled my way to enrolling a child that wasn't mine into school.
fctorial 6y ago
One of my online accounts has my city name as my first name because of autofill.
owenversteeg 6y ago
Exactly. This is also the reason why developers don't want autocomplete - the data is so much lower quality. So developers started by breaking browser autocomplete, to which browsers responded by ignoring developer preferences, to which developers respond with different tricks...
peruvian 6y ago
The autofill in Safari that uses your contact info is pretty reliable but I always triple check when I use it.
ant6n 6y ago
Autofill is a hot mess. If you have more than one address, and also occasionally fill up info for your partner, or with your work phone, things can really escalate. I think my Chrome has 20 different combinations of 2 names, 2 addresses, 2 phone numbers. And auto-fill always insists to fill out fields that have already been filled in - why can´t it just allow completion of a single form field, instead of putting in random information in all other fields. Before auto-fill, the fill-in suggestions for a single field actually used to be useful: start typing three letters and select the auto-suggested value. Now, every time I fill out a form I use the autofill suggestions as a way to remember the information that needs to be filled in. But I have to watch out like a hawk to not actually let it "fill" that exact phone number I`m typing in, otherwise it'll fuck up the whole form and force me to start over.

monkin 6y ago

It’s not 1Password fault, but poor design and implementation. :-)

neolog 6y ago
1Password filled his card expiration date into the dollars field.
smoldesu 6y ago
If it's not 1Password's fault, who's is it? Obviously this story had a happy ending, so it's not a terribly big issue, but 1Password's client ultimately passed along the unwanted data.
- freewilly1040 6y ago
  Clearly Substack. A UI that let's you specify 10X a price with no confirmation is (unintentionally in this case) malicious. This story could have easily been written about a user who fat fingered an extra 0 in the field.
  - ThePowerOfFuet 6y ago
    Unintentional malice? What?
- monkin 6y ago
  This field should be clearly visible, even if 1Password would mistakenly input data in there.
IncRnd 6y ago
The poor design and implementation of 1Password, you mean.
- chipotle_coyote 6y ago
  Speaking from personal experience -- over about six years at this point -- there are many, many web sites on the internets that 1Password's autofill works perfectly well on, and many others where it doesn't work perfectly but fails gracefully (or at least non-destructively). "Here is one site where it makes a mistake that could be catastrophic if you don't catch it" is just not a slam-dunk proof of 1Password being "poorly designed."
  - IncRnd 6y ago
    Ths is an appeal to authority. It is a shortcoming of the product's design for it to autofill a hidden field.
    - monkin 6y ago
      It’s visually hidden for us to see, not for 1Password auto fill mechanism.
      - FDSGSG 6y ago
        Which is a problem in the 1Password autofill mechanism. Unless you believe that it should be filling forms which are hidden from humans?
        monkin 6y ago
        So you want 1Password to check CSS of the form before auto filling? The form itself isn’t hidden it’s styled to be flat. That’s the biggest problem of it.
      - IncRnd 6y ago
        That exactly correct, which is why the fault is with 1Password's fill mechanism. A product has a bug when it does not produce output in-line with its stated purpose and process. Nobody would use a refrigerator that suddenly forgets to keep food cold when a carton of milk is placed on the shelf.
readflaggedcomm 6y ago
I don't trust autofill in what I use, either, Firefox or Keepass.
nodesocket 6y ago
Substack. A payment form should NOT allow you to enter any price in text fields, hidden or not.
- gberger 6y ago
  Why not? It's an arbitrary donation amount.

mercantile 6y ago

Similar situation here. I use 1Password every day, but I only trust it to autofill simple login forms. Where something more complex is happening, I tend to copy information over field by field. This was trained into me over the years as I saw 1Password do too many things that were wrong or even sometimes scary. The nominal benefit you get sometimes when it works properly isn't worth it. And yes, web providers should give their web forms better names and better semantic information (e.g. `<input type="email">`), but even in 2021 it's just not always the case.

CGamesPlay 6y ago
> And yes, web providers should give their web forms better names and better semantic information (e.g. `<input type="email">`), but even in 2021 it's just not always the case. Well, there's no semantic input for "year" or "currency", so there's nothing the form designer could do to stop 1Password from picking the wrong field. This does kinda get to the root of the issue, which is that 1Password has to do a lot of "cognitive" analysis of the page to find the forms it wants which is simultaneously why it does better than most autofillers, and has worse false positives than most autofillers. I am also a happy 1Password user, and I'll happily let it prefill a complex form for me, but I've caught enough of its mistakes in the past that I will always manually double check before submitting. I could also see myself making a similar mistake as this user on this form though (since it's so simple I might not manually double check).
- JimDabell 6y ago
  > Well, there's no semantic input for "year" or "currency", so there's nothing the form designer could do to stop 1Password from picking the wrong field. This is how you mark up the expiry year in a credit card form: <input autocomplete="cc-exp-year">
r00fus 6y ago
Mock me if you wish, but I tend to use 1Password for what it does best but use Apple’s Autofill for credit cards. It misses stuff sometimes but -fingers crossed - no issues with mis population into amount fields. I also use ApplePay or PayPal wherever possible to avoid data entry and reduce friction.

Waterluvian 6y ago

I once auto filled my way to enrolling a child that wasn't mine into school.

fctorial 6y ago

One of my online accounts has my city name as my first name because of autofill.

owenversteeg 6y ago

Exactly. This is also the reason why developers don't want autocomplete - the data is so much lower quality. So developers started by breaking browser autocomplete, to which browsers responded by ignoring developer preferences, to which developers respond with different tricks...

peruvian 6y ago

The autofill in Safari that uses your contact info is pretty reliable but I always triple check when I use it.

ant6n 6y ago

Autofill is a hot mess. If you have more than one address, and also occasionally fill up info for your partner, or with your work phone, things can really escalate. I think my Chrome has 20 different combinations of 2 names, 2 addresses, 2 phone numbers. And auto-fill always insists to fill out fields that have already been filled in - why can´t it just allow completion of a single form field, instead of putting in random information in all other fields. Before auto-fill, the fill-in suggestions for a single field actually used to be useful: start typing three letters and select the auto-suggested value. Now, every time I fill out a form I use the autofill suggestions as a way to remember the information that needs to be filled in. But I have to watch out like a hawk to not actually let it "fill" that exact phone number I`m typing in, otherwise it'll fuck up the whole form and force me to start over.