3 ms·

Are there any viable cases?

by orangepanda 5y ago

Lex-2008 5y ago
OTP one-time-password fields
- orangepanda 5y ago
  autocomplete="one-time-code" Any others?
  - Lex-2008 5y ago
    good point! But as soon as browsers stop autocompleting fields marked with autocomplete="one-time-code", won't website developers start marking _all_ input fields with this tag? After all, why do people put autocomplete="off" on input fields anyway?
    - scrollaway 5y ago
      autocomplete="one-time-code" causes a different type of autocomplete behaviour, it doesn't disable it. Specifically for example it will suggest a one time code you received by sms if one was recently sent (on mobile at least).
  - emilfihlman 5y ago
    Chrome recommends wrong passwords, passwords from wrong subdomains, and passwords for pages that will never accept custom passwords. It's broken as fuck.
  - rypskar 5y ago
    Admin page where you create users for other persons. Not cool when browsers try to add your password as password for all the users you create
    - orangepanda 5y ago
      Then there's autocomplete="new-password"
  - jimktrains2 5y ago
    Search fields. I don't want it filling in the users address or email address when they're searching for a customer. We have customer service representatives that accept orders over the phone, including credit card numbers. These should not get stored by the browser as autocomplete data.
- technion 5y ago
  Every time I logon to a certain system, Bitwarden types my password then I get a TOTP prompt. And it offers a pulldown menu half a screen long of previously entered codes.
ossopite 5y ago
Any business SaaS app where users like customer service representatives input data about their customers. Name, address, email, payment information and so on. Under no circumstances should these sort of input fields be autofilled.
- Aeolun 5y ago
  Or the data stored in the CSR browser history.
agogdog 5y ago
I worked on a site once that had mailing addresses autofilled into an anonymous survey field. It's a big vector for accidentally leaking personal information.

Are there any viable cases?

Lex-2008 5y ago

OTP one-time-password fields

orangepanda 5y ago
autocomplete="one-time-code" Any others?
- Lex-2008 5y ago
  good point! But as soon as browsers stop autocompleting fields marked with autocomplete="one-time-code", won't website developers start marking _all_ input fields with this tag? After all, why do people put autocomplete="off" on input fields anyway?
  - scrollaway 5y ago
    autocomplete="one-time-code" causes a different type of autocomplete behaviour, it doesn't disable it. Specifically for example it will suggest a one time code you received by sms if one was recently sent (on mobile at least).
- emilfihlman 5y ago
  Chrome recommends wrong passwords, passwords from wrong subdomains, and passwords for pages that will never accept custom passwords. It's broken as fuck.
- rypskar 5y ago
  Admin page where you create users for other persons. Not cool when browsers try to add your password as password for all the users you create
  - orangepanda 5y ago
    Then there's autocomplete="new-password"
- jimktrains2 5y ago
  Search fields. I don't want it filling in the users address or email address when they're searching for a customer. We have customer service representatives that accept orders over the phone, including credit card numbers. These should not get stored by the browser as autocomplete data.
technion 5y ago
Every time I logon to a certain system, Bitwarden types my password then I get a TOTP prompt. And it offers a pulldown menu half a screen long of previously entered codes.

ossopite 5y ago

Any business SaaS app where users like customer service representatives input data about their customers. Name, address, email, payment information and so on. Under no circumstances should these sort of input fields be autofilled.

Aeolun 5y ago
Or the data stored in the CSR browser history.

agogdog 5y ago

I worked on a site once that had mailing addresses autofilled into an anonymous survey field. It's a big vector for accidentally leaking personal information.