4 ms·

I really wish this attribute was never added. The idea that a site owner should have that much control over my browser’s behavior is completely contrary to the

I really wish this attribute was never added. The idea that a site owner should have that much control over my browser’s behavior is completely contrary to the concept of what a User Agent is intended to be. I’ve never seen a legitimate use case for disabling autocomplete, but have been prevented from using my password manager on many occasions, resulting in me having to either modify the source code via developer tools, type a very long password, or copy and paste it. Both of the last two cases increase the attack surface for passwords via key logging or clipboard snooping. The one case that has come close to being legitimate is shared computers, but that should be handled by security controls on the endpoint.

robocat 3y ago
Autofill assumes all fields are associated with the person who is sitting at the computer. That assumption is wrong for an administrator editing user configuration. You don't want the admin's name or address by default if the admin is configuring a new user. Or if the admin role is editing blank user data. Admins are often managers so you can't just disable autocomplete at the browser level.
- duskwuff 3y ago
  It's even worse for password fields. Browsers will aggressively attempt to fill the user's password into any password input, regardless of whether it's part of the site's login form or not. This works for most web sites, most of the time -- but it fails horribly for sites where the user really does need to enter a password for something else, like if you're setting a password on a wireless network or setting credentials on a new user you're creating.
- anymouse123456 3y ago
  This. But also for any data for any enumerated type. It's so effing stupid and short sighted.
daveoc64 3y ago
>I’ve never seen a legitimate use case for disabling autocomplete The main one is going to be any kind of web system where the user is typing in other people's details. Search fields can also be a bit annoying - I've seen Firefox autocomplete entries in search fields that make no sense. For example, Firefox suggests my postal code as a search term here on HN.

robocat 3y ago

Autofill assumes all fields are associated with the person who is sitting at the computer. That assumption is wrong for an administrator editing user configuration. You don't want the admin's name or address by default if the admin is configuring a new user. Or if the admin role is editing blank user data. Admins are often managers so you can't just disable autocomplete at the browser level.

duskwuff 3y ago
It's even worse for password fields. Browsers will aggressively attempt to fill the user's password into any password input, regardless of whether it's part of the site's login form or not. This works for most web sites, most of the time -- but it fails horribly for sites where the user really does need to enter a password for something else, like if you're setting a password on a wireless network or setting credentials on a new user you're creating.
anymouse123456 3y ago
This. But also for any data for any enumerated type. It's so effing stupid and short sighted.

daveoc64 3y ago

>I’ve never seen a legitimate use case for disabling autocomplete The main one is going to be any kind of web system where the user is typing in other people's details. Search fields can also be a bit annoying - I've seen Firefox autocomplete entries in search fields that make no sense. For example, Firefox suggests my postal code as a search term here on HN.