17 ms·
The war against autocomplete=off (2013)
- deleted 13y ago[deleted]
- wyager 13y agoI've run into the problem of web services not letting me store passwords. The reality is, if you let my password manager (safari jacks into OS X's keychain system) keep track of things, I'm going to use the random 12-digit alphanumeric password my password manager provides me. If you don't, I'm either going to use my shitty "brain" password or put it in my password manager anyway and just copy-paste it manually. Thankfully, safari on both iOS and OS X has a toggle to ignore autocomplete=off, which I take advantage of liberally.
- mrfusion 13y agoWhere is the toggle in iOS? That would be really useful.
- stephengillie 13y agoI haven't encountered this issue in Windows with a 3rd party password manager, but I copypasta anyway because I don't like auto-entry.
- rip747 13y agohttp://xkcd.com/936 http://xkcd.com/936
- mietek 13y agoSo, does Safari manage to autocomplete the PayPal password for you?
- shittyanalogy 13y agoHow does it break password managers? Does it prevent them from auto-filling in or auto-saving the password? I use passpack and enter/retrieve my credentials manually and so don't experience this and appreciate autocomplete=off.
- freehunter 13y agoI don't think I've run into a situation where LastPass has been unable to auto-fill a form. Is this a feature of LastPass, or have I just not gone to sites that disallow autocomplete?
- pwman 13y agoLastPass has a setting to respect autocomplete -- it's off by default because so many sites use it inappropriately.
- odin1415 13y agoIt's the latter. I use LastPass too, and there's one particular site where it doesn't autofill, because of autocomplete=off. It's just one site, but incredibly annoying because I use it often multiple times per day (and of course it doesn't allow me to stay logged in either.)
- aris_ada 13y agoI did not test LastPass and 1Password, only FF sync & Keepass. And it was a while ago.
- wglb 13y agoThe issue may be moot--IE 11 ignores autocomplete=off. And in any case, for the cases where this setting is effective, it doesn't break password managers--just set your password manager to not fill the fields, but use copy and paste for the password. [Edit - spelling]
- yukichan 13y ago1password makes this never be an issue for me. ⌘+/ to log into anything with one stroke, unless I have multiple accounts for the site, in which case it's a couple of extra clicks.
- deleted 13y ago[deleted]
- wernercd 13y agoSame for KeePass (Cntrl + Alt + A). Never had an issue now that I use it fairly consistently. Key is I guess not using browser stores.
- choult 13y agoThis drives some of our customers nuts because autocomplete has the annoying tendency in the most recent Safari of overwriting prepopulated fields - users end up losing configurations over this. Otherwise I can see the benefit of ignoring the setting, perhaps, but we need consistent default behavior (chance would be a fine thing!). I don't want to be telling my customers that they should switch off autocomplete as a user shouldn't need to configure a browser to use a website!
- bdash 13y agoHave you filed a bug report about Safari overwriting prepopulated fields? If not, and you don't want to deal with the painful experience that is bugreport.apple.com, feel free to drop me an email with more details about what you're seeing.
- choult 13y agoI'll drop you a line on Monday when I can scrabble together something better than swearing :P
- michaelbehan 13y agoThis article uses "password managers" ambiguously. In my opinion, a browser is a terrible password manager because of what is stated in the "pros" section of the article. My advice aligns with others who have replied here - get a real password manager such as 1password and allow autocomplete="off" to do what it is supposed to do.
- claudius 13y agoSorry, but which of the two points in the ‘pro’ section (storing truly sensitive visible information and hacking of client-site databases) makes a browser less capable of acting as a password manager than a ‘real’ password manager? Or maybe you could rephrase why you think browsers are terrible password managers? I’m quite fond of Opera’s Wand.
- dasil003 13y agoI'm going to go out on a limb and suggest just because 1password is really really good. So good that I don't even want to try a browser's password manager (especially since I want access to my passwords on multiple browsers and my phone/tablet as well). I'm sure browser password managers have made leaps and bounds, but so as 1password and it's amazing.
- 205guy 13y agoThe original article fails to take into account the larger population. The basic password managers in browsers are huge security holes. The one in FF does not use a master password by default, so anyone could look at an unattended computer and see all stored passwords with a few clicks. The article mentions an old JavaScript attack on the passwords as well (but then dismisses the threat, since that one hole was patched). So the problem really is that the browsers pushed insecure features out to the masses, and many people adopted them. The number of people in the general population who use a password manager is low (obviously it is high here on HN). So think of the autocomplete=off flag as a flag to make sure you are using a competent password manager, one that recognizes the problem and then overrides the flag. Sounds like Safari and IE 11 are already doing that, so hopefully they fixed the problems of the early password managers.
- spindritf 13y agoCompared to weak passwords, phishing and a myriad other threats, how likely is that someone will walk up to my computer and copy a password? How likely are they to have a true criminal intent rather than a prank on their mind? And when your machine is compromised or otherwise controlled by an untrustworthy third party, you lost anyway.
- tptacek 13y agoNobody is arguing that autocomplete is a threat on par with phishing.
- rz2k 13y agoI think the argument is that you are less likely to use the same password on every site and service, or easily guessed passwords, if you are allowed to use a password manager. In other words, in practice there is an actual tradeoff between the two.
- Retric 13y agoHowever, auto complete is a great way to fight phishing. It's easy to tell people you think your on website X but your password never shows up your probably on a different site. And the simple fact there password is not there is enough to get most people get somewhat paranoid. So, for most people you trade a near meaningless threat to fight a major one which tends to be a net win.
- penguindev 13y ago> Please note that if you combine this policy and at the same time disable copy and paste into the password fields (I look at you, Blizzard!), I hate you. oh man. disabling paste is the worst, because it breaks keypassx. (Apple did this last I checked!) turbotax did that as well last year, this year they made it sane again. Luckily there's a firefox about:config setting you can do to not let websites hijack / block your clipboard events.
- odin1415 13y agoIf you hit ctrl+v in keepassx it should "autotype" your password for you, bypassing any paste blocking.
- usea 13y agoAnother way to bypass these fields where you can't paste a password (many games are guilty of this atrocity): make an AutoHotkey[1] script for rapidly typing whatever is in your clipboard. This line will make ctrl-alt-v type your clipboard: ^+v::SendRaw %clipboard% [1] http://www.autohotkey.com/ http://www.autohotkey.com/
- aris_ada 13y agoSeriously, blocking copy & paste, what are they thinking they protect from ? (blogpost writer here)
- ubercow13 13y agoAnd Paypal! I closed my paypal account because of that
- badman_ting 13y agoRight, this isn't what autocomplete=off is for. It's for fields where correcting the user's input to dictionary words is of negative utility, for example, typing stock tickers should not correct "aapl" to "apple".
- smackfu 13y agoIsn't that the "autocorrect" option?
- badman_ting 13y agoDuhh, right you are. I keep conflating the two.
- gdulli 13y agoI used to use Chrome as my second browser, where I'd keep my work gmail account up. Recently it started to no longer save my password, even with an autocomplete=on plugin installed that works on other sites. That was my catalyst for uninstalling Chrome altogether and moving to Firefox for everything.
- JelteF 13y agoChromeIPass (Keepass autofill for Chrome) just ignores this as far as I know.
- joshuahedlund 13y ago> Tell me how I am supposed to fulfill these requirements if I need 20 websites daily to do my work ? One solution to this problem (or at least one way to severely mitigate it) is to use a base word that you tweak with a simple algorithm based on the first letter, last letter, number of letters in the domain, etc. Of course some websites have mutually exclusive requirements, so this doesn't work for all sites, but I've been doing this for so many years now that while I have muscle memory for frequently used sites, I can go to a site I haven't been to in years and have no memory of the actual characters in the password, but I apply my algorithm and voila, it works!
- ToastyMallows 13y agoI changed all my passwords recently to do the same thing. The problem I've recently started to see is that, let's say for example my hashed+salted password is stolen from a site. If they brute-force figure out what my password is, they'll have my "base word" and all my other accounts may still be able to be compromised. Recently I changed my big accounts (Google, Facebook, StackOverflow) to have a slightly different "base word" and the other accounts that I can afford to lose control of have stayed the same.
- smileysteve 13y agoIt's significantly more difficult to reuse the base and figure out the additional characters than it is to get access to the user whose password is 'password' For insecure services that I use on mobile, public, etc computers, I do this.
- ebiester 13y agoWhat do you do when you have to change a password for a site? Multiple algorithms? Hrmmn... when did I last set this password?
- joshuahedlund 13y agoForced password changes are the biggest downside I've run into... I had to resort to a modified algorithm when LinkedIn was hacked, for instance. But for 90%+ of the websites I use it on, especially social networks and forums and the like, it's hardly ever an issue.
- brianpgordon 13y agoI just use this bookmarklet to remove "autocomplete=off" from form elements: javascript:(function(){var%20c=0;function%20R(w){try{var%20a,df,dfe,i,j,x,y,r=1;df=w.document.forms;for(i=0;x=df[i];++i){dfe=x.elements;if(a=x.onsubmit){a=""}if(a=x.attributes["autocomplete"]){if(a.value=="on"){c++}a.value="on"}for(j=0;y=dfe[j];++j){if(a=y.attributes["autocomplete"]){if(a.value=="on"){c++}a.value="on"}}}}catch(E){r=0}return%20r}R(self);var%20i,x;for(i=0;x=frames[i];++i)R(x);if(c){alert("Found:%20"+c)}})();
- yonran 13y agoThere’s also the Chrome extension autocomplete=on from a Chromium author: https://chrome.google.com/webstore/detail/autocomplete-on/ecpgkdflcnofdbbkiggklcfmgbnbabhh https://chrome.google.com/webstore/detail/autocomplete-on/ec...
- lugg 13y agoAlso use this. Much love for the author.
- jonmetz 13y agoShameless plug: I dot so worked up over this kind of nonsense one day that I wrote a firefox addon to turn autocomplete on. https://addons.mozilla.org/En-us/firefox/addon/autocompleteanywhere/ https://addons.mozilla.org/En-us/firefox/addon/autocompletea...
- malandrew 13y agoCould you not run an analysis of a user's password on account creation or password reset that determines if it is likely to be autogenerated and managed by a password manager. Then armed with this flag enable or disable autocomplete on a user by user basis with javascript?
- talklittle 13y agoOn Firefox: 1. Go to about:config 2. Right-click anywhere, New -> Boolean: signon.overrideAutocomplete Value: true More info: https://bugzilla.mozilla.org/show_bug.cgi?id=425145 https://bugzilla.mozilla.org/show_bug.cgi?id=425145 EDIT: Based on the milestone set on that issue, this setting requires Firefox 29. Another workaround is this bookmarklet: https://www.squarefree.com/bookmarklets/forms.html#remember_password https://www.squarefree.com/bookmarklets/forms.html#remember_... referenced from comment https://bugzilla.mozilla.org/show_bug.cgi?id=425145#c16 https://bugzilla.mozilla.org/show_bug.cgi?id=425145#c16
- stcredzero 13y agoMy biggest problem is with sites that don't let me copy/paste into the password field. WTF!? Who's the PHB that came up with this policy? Despite this misguided nannying, I still use randomly generated 22 character alphanumeric passwords, even if I have to open up the window in Keepass and manually type them in. Most people aren't as paranoid and anal as me, however. Whoever you are, you're basically encouraging people to use weak passwords. Ironic, as it seems to be banks that are most often guilty of this.
- lambeosaurus 13y agoEqually bad: requiring a user to never use the same password twice Come on, I only forgot my password and want to set it to what I think it should be! I didn't get hacked! Just let me live my life in peace!
- aruggirello 13y agoWorse yet, there are banks that don't let you use any of the last 3-5 passwords. This is really annoying, especially when combined with enforcing a password change every 3 or 6 months. But there is a solution: just use whatever password you have chosen, and add a number for the current quarter or semester. Until they come up with a password strength checker measuring the similarity between your current and previous passwords (eg. levenshtein()), you should be ok.
- stcredzero 13y agoUntil they come up with a password strength checker measuring the similarity between your current and previous passwords (eg. levenshtein()), you should be ok. These have appeared in Ubuntu.
- kybernetyk 13y agoThe first thing I install in a new browser is an adblocker. The second thing an addon that disables autocomplete=off. Yes I'm lazy. But my laptop is encrypted and goes back to the login screen after 2 minutes of inactivity. To me autocomplete=off is just annoying and doesn't add any security.
- psychometry 13y agoI used to be annoyed by autocomplete=off until I started using 1Password. Now, I actually tell Chrome to disable auto-filling of forms since I can fill the form fields with 1Password, which is the only place I'm keen to store personal information.
- taf2 13y agoit really helps with forms where you are an admin and can edit other users information... in these forms when autocomplete is on... and starts populating your information into the user you're trying to edit... well... things just get pretty messed up...
- ams6110 13y agoThe first thing I do in a new browser is globally turn off autocomplete for all forms and disable "remember passwords."
- yaur 13y agoI'm going to go with Bruce Schneier on this one and say that there is absolutely nothing wrong with writing your passwords down. If someone mugs me and takes my wallet there is a 99% chance they are going to get the phone too and I'll need to change all my passwords anyway. Not letting the browser cache them is still dumb though.
- pkulak 13y agohttps://chrome.google.com/webstore/detail/autocomplete-on/ecpgkdflcnofdbbkiggklcfmgbnbabhh https://chrome.google.com/webstore/detail/autocomplete-on/ec... My favorite extension.
- raldi 13y agoDoesn't work on Airbnb, though.
- raldi 13y agoIs it me, or is there no way to force Airbnb to allow Chrome to remember my password, even with an extension?
- Sir_Cmpwn 13y agoOnly slightly related, but I really wish GitHub would add autocomplete=off on the language selection dropdown for Gist. If you make your own autocomplete UI, I would prefer that you disable the browser UI.
- SloopJon 13y agoSomeone was showing me Capital One 360 (formerly ING), which uses an onscreen PIN pad that you either have to click with your mouse, or type using a randomly generated mapping. The idea is to thwart keystroke loggers, but it's totally infuriating.
- duskwuff 13y agoThe worst part is, it doesn't even thwart keyloggers very well! It's not uncommon for password stealing malware to detect when the user is viewing a site that uses a "PIN pad" login of this type, and start taking screenshots surrounding the location of each click to capture input.
- matt-attack 13y agoI use: https://addons.mozilla.org/en-US/firefox/addon/remember-passwords/ https://addons.mozilla.org/en-US/firefox/addon/remember-pass... It's heavenly.