6 ms·

> Ignore autocomplete="off" when offering to save passwords via the password manager Love this change. There's some good conversations in Bugzilla about it. [

> Ignore autocomplete="off" when offering to save passwords via the password manager Love this change. There's some good conversations in Bugzilla about it. [0] [0]: https://bugzilla.mozilla.org/show_bug.cgi?id=956906 https://bugzilla.mozilla.org/show_bug.cgi?id=956906

sdfjkl 12y ago
That's one less script in my Greasemonkey.
araes 12y ago
This has been one of my most reviled features of the modern web that autocomplete is almost universally turned off for passwords. This often even extends to integrated password managers. Could not be happier this has been changed, although for most of my life I'll still suffer behind an ESR version without it. As one of the comments in the discussion notes, also possibly better for security. Manual entry is a negative incentive for complex passwords (reduces average complexity across the whole userbase). It also preferences keylogger attacks, which is one of the most widespread computer infections.
- Kiro 12y ago
  Why ESR?
  - JohnTHaller 12y ago
    Probably what's being forced on them at work. That's generally the only place ESR is used. It's actually all it's meant for (large scale corporate/organization rollouts where they need to test and peg a specific version for use with web apps). Though you can have Firefox ESR installed and use it as your primary while still having a copy of Firefox Portable handy for other user on a flash drive or even right in My Documents.
  - insertnickname 12y ago
    I use it to avoid Australis (but still getting security updates).
    - Excavator 12y ago
      You don't find themes like Simple White¹ or FT DeepDark² to be acceptable? 1: https://addons.mozilla.org/en-US/firefox/addon/simplewhite/ https://addons.mozilla.org/en-US/firefox/addon/simplewhite/ 2: https://addons.mozilla.org/en-US/firefox/addon/ft-deepdark/ https://addons.mozilla.org/en-US/firefox/addon/ft-deepdark/
      - vacri 12y ago
        The themes don't change the arrangement of the UI.
        pooper 12y ago
        Try Debian if you need something so rock solid that you can only get security updates.
        vacri 12y ago
        I do use Debian for my desktop. So? I still have Australis. The themes don't change that fact.
    - malnourish 12y ago
      If you're on Windows or Linux try Palemoon [0]. [0]: http://www.palemoon.org/ http://www.palemoon.org/
- raving-richard 12y ago
  javascript:(function(){var%20ca,cea,cs,df,dfe,i,j,x,y;function%20n(i,what){return%20i+"%20"+what+((i==1)?"":"s")}ca=cea=cs=0;df=document.forms;for(i=0;i<df.length;++i){x=df[i];dfe=x.elements;if(x.onsubmit){x.onsubmit="";++cs;}if(x.attributes["autocomplete"]){x.attributes["autocomplete"].value="on";++ca;}for(j=0;j<dfe.length;++j){y=dfe[j];if(y.attributes["autocomplete"]){y.attributes["autocomplete"].value="on";++cea;}}}alert("Removed%20autocomplete=off%20from%20"+n(ca,"form")+"%20and%20from%20"+n(cea,"form%20element")+",%20and%20removed%20onsubmit%20from%20"+n(cs,"form")+".%20After%20you%20type%20your%20password%20and%20submit%20the%20form,%20the%20browser%20will%20offer%20to%20remember%20your%20password.")})(); Copy and paste that code into a bookmarklet, and it will do what you want.
Manishearth 12y ago
Glad you like it. While I didn't make this change myself, I made the change that sparked this discussion (and was a part of the discussion). Been getting mails about it on both sides of the spectrum :P It really was a illogical feature. Too much power to the website, and as one person put it, "When the browser fails to fill in my password for me, I must assume that the browser is broken".
- ToastyMallows 12y ago
  Agree with the quote 100%. I think the really telling part was that IE11 is already doing this.[0] [0]: http://msdn.microsoft.com/en-us/library/ie/ms533486 http://msdn.microsoft.com/en-us/library/ie/ms533486
chrissr 12y ago
This is going to cause trouble with several websites that use "password" inputs for other sensitive data like credit card numbers and SSNs. The discussion mentions that this is a misuse of the password input, but it's a very common misuse of it. The discussion stresses that Firefox is the third major browser to implement this feature, but what I don't think they understand is that their username/password detection algorithm is the weakest of the three browsers. If I create a form that contains a dozen fields, one of which is labeled "Owner's Email" (type=text) and another that is labeled "Owner's SSN" (type=password) with several fields in between, Firefox thinks this is a login and prompts the user to save this information. Chrome and IE are smart enough to recognize that just because an email address and password field were somewhere on the same form, that this isn't login information. We've addressed this issue in the past by turning autocomplete=off for the SSN field, but now we'll have to re-implement input type=password using input type=text with some javascript. Otherwise, our users are going to accidentally click "Yes" at some point when prompted to save their password and have the form auto-filled for each subsequent entry.
- jhasse 12y ago
  What about them wanting to save the field? Don't tell your users what to save and what not to. It's REALLY annoying!
  - chrissr 12y ago
    Because the value will be different every time the user uses the application. These are basically data entry people keying in paper forms all day.
    - jhasse 12y ago
      Why not use type="text" then?
- phantom784 12y ago
  I recently ran into an issue where the browser was auto-completing a mail server configuration form, assuming that it was the login for the site. Luckily, adding a value="" attribute to the password field fixed it for me (and still works in Firefox 30).
habosa 12y ago
I heard from someone on the Chrome team that the reason that Chrome respects this behavior is that many of these websites will resort to "please use a supported browser such as: Safari" tactics if Chrome ignores autocomplete=off. Those were one of the worst parts of the web 5+ years ago and I'd hate to see them come back for FF users.
- magicalist 12y ago
  hmm, but didn't Chrome start ignoring autocomplete=off for password fields[1]? And Safari was already doing it, and now it's not even an option to turn it back on. [1] https://groups.google.com/a/chromium.org/forum/#!msg/chromium-dev/zhhj7hCip5c/PxbtDtGbkV0J https://groups.google.com/a/chromium.org/forum/#!msg/chromiu...
  - habosa 12y ago
    Hmm interesting, maybe they did. I heard this almost a year ago (Summer 2013) so they could have come around. If 2 or 3 of the major browser vendors would make this move it would put pressure on the webmasters (do people still say webmaster?) to just deal with it.

sdfjkl 12y ago

That's one less script in my Greasemonkey.

araes 12y ago

This has been one of my most reviled features of the modern web that autocomplete is almost universally turned off for passwords. This often even extends to integrated password managers. Could not be happier this has been changed, although for most of my life I'll still suffer behind an ESR version without it. As one of the comments in the discussion notes, also possibly better for security. Manual entry is a negative incentive for complex passwords (reduces average complexity across the whole userbase). It also preferences keylogger attacks, which is one of the most widespread computer infections.

Kiro 12y ago
Why ESR?
- JohnTHaller 12y ago
  Probably what's being forced on them at work. That's generally the only place ESR is used. It's actually all it's meant for (large scale corporate/organization rollouts where they need to test and peg a specific version for use with web apps). Though you can have Firefox ESR installed and use it as your primary while still having a copy of Firefox Portable handy for other user on a flash drive or even right in My Documents.
- insertnickname 12y ago
  I use it to avoid Australis (but still getting security updates).
  - Excavator 12y ago
    You don't find themes like Simple White¹ or FT DeepDark² to be acceptable? 1: https://addons.mozilla.org/en-US/firefox/addon/simplewhite/ https://addons.mozilla.org/en-US/firefox/addon/simplewhite/ 2: https://addons.mozilla.org/en-US/firefox/addon/ft-deepdark/ https://addons.mozilla.org/en-US/firefox/addon/ft-deepdark/
    - vacri 12y ago
      The themes don't change the arrangement of the UI.
      - pooper 12y ago
        Try Debian if you need something so rock solid that you can only get security updates.
        vacri 12y ago
        I do use Debian for my desktop. So? I still have Australis. The themes don't change that fact.
  - malnourish 12y ago
    If you're on Windows or Linux try Palemoon [0]. [0]: http://www.palemoon.org/ http://www.palemoon.org/
raving-richard 12y ago
javascript:(function(){var%20ca,cea,cs,df,dfe,i,j,x,y;function%20n(i,what){return%20i+"%20"+what+((i==1)?"":"s")}ca=cea=cs=0;df=document.forms;for(i=0;i<df.length;++i){x=df[i];dfe=x.elements;if(x.onsubmit){x.onsubmit="";++cs;}if(x.attributes["autocomplete"]){x.attributes["autocomplete"].value="on";++ca;}for(j=0;j<dfe.length;++j){y=dfe[j];if(y.attributes["autocomplete"]){y.attributes["autocomplete"].value="on";++cea;}}}alert("Removed%20autocomplete=off%20from%20"+n(ca,"form")+"%20and%20from%20"+n(cea,"form%20element")+",%20and%20removed%20onsubmit%20from%20"+n(cs,"form")+".%20After%20you%20type%20your%20password%20and%20submit%20the%20form,%20the%20browser%20will%20offer%20to%20remember%20your%20password.")})(); Copy and paste that code into a bookmarklet, and it will do what you want.

Manishearth 12y ago

Glad you like it. While I didn't make this change myself, I made the change that sparked this discussion (and was a part of the discussion). Been getting mails about it on both sides of the spectrum :P It really was a illogical feature. Too much power to the website, and as one person put it, "When the browser fails to fill in my password for me, I must assume that the browser is broken".

ToastyMallows 12y ago
Agree with the quote 100%. I think the really telling part was that IE11 is already doing this.[0] [0]: http://msdn.microsoft.com/en-us/library/ie/ms533486 http://msdn.microsoft.com/en-us/library/ie/ms533486

chrissr 12y ago

This is going to cause trouble with several websites that use "password" inputs for other sensitive data like credit card numbers and SSNs. The discussion mentions that this is a misuse of the password input, but it's a very common misuse of it. The discussion stresses that Firefox is the third major browser to implement this feature, but what I don't think they understand is that their username/password detection algorithm is the weakest of the three browsers. If I create a form that contains a dozen fields, one of which is labeled "Owner's Email" (type=text) and another that is labeled "Owner's SSN" (type=password) with several fields in between, Firefox thinks this is a login and prompts the user to save this information. Chrome and IE are smart enough to recognize that just because an email address and password field were somewhere on the same form, that this isn't login information. We've addressed this issue in the past by turning autocomplete=off for the SSN field, but now we'll have to re-implement input type=password using input type=text with some javascript. Otherwise, our users are going to accidentally click "Yes" at some point when prompted to save their password and have the form auto-filled for each subsequent entry.

jhasse 12y ago
What about them wanting to save the field? Don't tell your users what to save and what not to. It's REALLY annoying!
- chrissr 12y ago
  Because the value will be different every time the user uses the application. These are basically data entry people keying in paper forms all day.
  - jhasse 12y ago
    Why not use type="text" then?
phantom784 12y ago
I recently ran into an issue where the browser was auto-completing a mail server configuration form, assuming that it was the login for the site. Luckily, adding a value="" attribute to the password field fixed it for me (and still works in Firefox 30).

habosa 12y ago

I heard from someone on the Chrome team that the reason that Chrome respects this behavior is that many of these websites will resort to "please use a supported browser such as: Safari" tactics if Chrome ignores autocomplete=off. Those were one of the worst parts of the web 5+ years ago and I'd hate to see them come back for FF users.

magicalist 12y ago
hmm, but didn't Chrome start ignoring autocomplete=off for password fields[1]? And Safari was already doing it, and now it's not even an option to turn it back on. [1] https://groups.google.com/a/chromium.org/forum/#!msg/chromium-dev/zhhj7hCip5c/PxbtDtGbkV0J https://groups.google.com/a/chromium.org/forum/#!msg/chromiu...
- habosa 12y ago
  Hmm interesting, maybe they did. I heard this almost a year ago (Summer 2013) so they could have come around. If 2 or 3 of the major browser vendors would make this move it would put pressure on the webmasters (do people still say webmaster?) to just deal with it.