5 ms·

From the changelog: > autocomplete=off is no longer supported for username/password fields As far as I can recall, autocomplete=off was originally added speci

From the changelog: > autocomplete=off is no longer supported for username/password fields As far as I can recall, autocomplete=off was originally added specifically for username and password fields, so somebody who nicked your laptop couldn't go to your bank's website and have your username and password filled in. As a power user I find autocomplete=off pretty annoying, but I've got ways to work around it. I'm very curious what the rationale for this change is.

openjck 12y ago
Lots of great discussion in the bug: https://bugzilla.mozilla.org/show_bug.cgi?id=956906 https://bugzilla.mozilla.org/show_bug.cgi?id=956906
- ploxiln 12y ago
  quote near end for the many people who won't read the thread: - This change makes it so that `autocomplete=off` does not stop the Password Manager from working. Normal form autofill can be disabled as usual. - The password manager *always* prompts if it wants to save a password. Passwords are not saved without permission from the user. - We are the third browser to implement this change, after IE and Chrome. More clarification: password type input elements already never autofill/autocomplete like other input elements do. autocomplete=off on password type input elements just makes password managers not work (until this change). Other input elements still honor autocomplete=off.
- fpgeek 12y ago
  Lots of great discussion, but also lots of exasperating third-party comments. While reading some of them I wanted to shake the authors and scream: "A website can't stop a user from saving a password! All you're doing is making them save it on a Post-It instead of in their password manager!"
leeoniya 12y ago
for backend admin, when creating usernames and passwords for new users, you dont want those saved in your own browser. pretty much the only use-case i've run into and can think of.
- pasbesoin 12y ago
  I've worked on use cases in both work and home environments. Remember, a few years ago, not everyone had their own computer. For large chunks of the world (demographically and geographically), this is still the case. Shared computer? You want to be applying autocomplete=off to sensitive fields. It's no guarantee, but it's one layer, assuming other layers (e.g. preventing keyloggers) are being maintained. Only, I guess, you won't have this option, any longer. At one point, I had to get one of my banks (big, "evil", you've heard of them) to apply it to their login web page. And I worked for another very big corporation that had at least in some people some pretty clueful in house developers. We applied it, as well. There were, and are, valid use cases. The setting alone won't save you, but it's one piece of a broader approach. P.S. Oh yeah, and I seem to recall nudging a domain name registrar to apply it to the credit card number field on their payments page.
  - ploxiln 12y ago
    Browsers already automatically disable auto-complete from form history for "password" type input elements, this "autocomplete=off" would additionally prevente password managers from working. So that's what this change does: password managers will work, but password input fields still don't actually auto-complete from form history. You should still be able to use autocomplete=off for non-password fields, like credit card.
    - pasbesoin 12y ago
      Thank you for the clarification. I should have read through everything.
- pbhjpbhj 12y ago
  Doesn't private tabs solve that?
Apofis 12y ago
Lastpass saves me hours every week with their Auto Login and Form Fill features. If they are to be believed, all your stuff is encrypted on their servers. If you lose your master password, your screwed, so I don't think someone like the NSA or a hacker can get access to my login data. The only way you can recover a lastpass account is if you do it from a computer that was already authenticated with lastpass in the near past.

openjck 12y ago

Lots of great discussion in the bug: https://bugzilla.mozilla.org/show_bug.cgi?id=956906 https://bugzilla.mozilla.org/show_bug.cgi?id=956906

ploxiln 12y ago
quote near end for the many people who won't read the thread: - This change makes it so that `autocomplete=off` does not stop the Password Manager from working. Normal form autofill can be disabled as usual. - The password manager *always* prompts if it wants to save a password. Passwords are not saved without permission from the user. - We are the third browser to implement this change, after IE and Chrome. More clarification: password type input elements already never autofill/autocomplete like other input elements do. autocomplete=off on password type input elements just makes password managers not work (until this change). Other input elements still honor autocomplete=off.
fpgeek 12y ago
Lots of great discussion, but also lots of exasperating third-party comments. While reading some of them I wanted to shake the authors and scream: "A website can't stop a user from saving a password! All you're doing is making them save it on a Post-It instead of in their password manager!"

leeoniya 12y ago

for backend admin, when creating usernames and passwords for new users, you dont want those saved in your own browser. pretty much the only use-case i've run into and can think of.

pasbesoin 12y ago
I've worked on use cases in both work and home environments. Remember, a few years ago, not everyone had their own computer. For large chunks of the world (demographically and geographically), this is still the case. Shared computer? You want to be applying autocomplete=off to sensitive fields. It's no guarantee, but it's one layer, assuming other layers (e.g. preventing keyloggers) are being maintained. Only, I guess, you won't have this option, any longer. At one point, I had to get one of my banks (big, "evil", you've heard of them) to apply it to their login web page. And I worked for another very big corporation that had at least in some people some pretty clueful in house developers. We applied it, as well. There were, and are, valid use cases. The setting alone won't save you, but it's one piece of a broader approach. P.S. Oh yeah, and I seem to recall nudging a domain name registrar to apply it to the credit card number field on their payments page.
- ploxiln 12y ago
  Browsers already automatically disable auto-complete from form history for "password" type input elements, this "autocomplete=off" would additionally prevente password managers from working. So that's what this change does: password managers will work, but password input fields still don't actually auto-complete from form history. You should still be able to use autocomplete=off for non-password fields, like credit card.
  - pasbesoin 12y ago
    Thank you for the clarification. I should have read through everything.
pbhjpbhj 12y ago
Doesn't private tabs solve that?

Apofis 12y ago

Lastpass saves me hours every week with their Auto Login and Form Fill features. If they are to be believed, all your stuff is encrypted on their servers. If you lose your master password, your screwed, so I don't think someone like the NSA or a hacker can get access to my login data. The only way you can recover a lastpass account is if you do it from a computer that was already authenticated with lastpass in the near past.