4 ms·

Anyone have any insight on why they removed autocomplete from username & password fields?

phireal 11y ago
Presumably this: https://bugzilla.mozilla.org/show_bug.cgi?id=956906 https://bugzilla.mozilla.org/show_bug.cgi?id=956906 I think it means that sites can't overrule the browser's inclination to store passwords. The argument seems to be the browser makers will store passwords safely.
- dao- 11y ago
  > The argument seems to be the browser makers will store passwords safely. Not quite. Unless you set a master password, whoever owns your computer will own the passwords stored by your browser. The argument is that disabling autocomplete makes users choose poor passwords that are easy to remember, or write passwords down somewhere, which is at least as bad as having passwords stored in your browser profile.
  - quadrangle 11y ago
    writing passwords down somewhere, such as on PAPER, is not a particularly bad idea unless you keep the paper by your computer.
- sandstrom 11y ago
  There are some valid use-cases, e.g. in web-apps with an user-admin section. It's useful that when adding user 2 (or N) it won't auto-fill with details from the previous user (that you just added). If anyone has that issue, a workaround is to add multiple email/password inputs (dummies) around the real-one, and hide them. In Chrome, this causes it to 'give up' and not try to auto-fill the fields.
gear54rus 11y ago
They removed the ability of a site maker to tell user if they should use password manager on their website. A much needed feature aka 'no, I do not care about password for your stupid site'.
- aroch 11y ago
  IMO, what's even more annoying are sites that detect whether you've used a password manager to fill your credentials and then 1) won't log you in, 2) frequently require you to clear your cookies and 3) sometimes make you change your password.
  - dolske 11y ago
    Do you have examples of such sites? I'd be interested in seeing what they're doing, and how we can fix password manager to avoid that.
    - aroch 11y ago
      Either Uni. of Wisconsin or Baylor (at least the graduate application stuff) was one of them
- hobarrera 11y ago
  They also removed the ability of a site maker to tell the browser "no, this isn't the user's login form, it's where he inputs the username of somebody else".
riquito 11y ago
From the bug tracker https://bugzilla.mozilla.org/show_bug.cgi?id=956906#c100 https://bugzilla.mozilla.org/show_bug.cgi?id=956906#c100 Summary of the change, so people don't have to wade through a long discussion: - This change makes it so that `autocomplete=off` does not stop the Password Manager from working. Normal form autofill can be disabled as usual. - The password manager *always* prompts if it wants to save a password. Passwords are not saved without permission from the user. - We are the third browser to implement this change, after IE and Chrome. - This can be undone locally by flipping the `signon.storeWhenAutocompleteOff` pref (from about:config) off. - The rationale behind this change was the widespread abuse of the `autocomplete` attribute to prevent password saving where no prevention is required. This change gives users full control over password saving, without compromising on security (again, the user is always prompted).

Presumably this: https://bugzilla.mozilla.org/show_bug.cgi?id=956906 https://bugzilla.mozilla.org/show_bug.cgi?id=956906 I think it means that sites can't overrule the browser's inclination to store passwords. The argument seems to be the browser makers will store passwords safely.

dao- 11y ago
> The argument seems to be the browser makers will store passwords safely. Not quite. Unless you set a master password, whoever owns your computer will own the passwords stored by your browser. The argument is that disabling autocomplete makes users choose poor passwords that are easy to remember, or write passwords down somewhere, which is at least as bad as having passwords stored in your browser profile.
- quadrangle 11y ago
  writing passwords down somewhere, such as on PAPER, is not a particularly bad idea unless you keep the paper by your computer.
sandstrom 11y ago
There are some valid use-cases, e.g. in web-apps with an user-admin section. It's useful that when adding user 2 (or N) it won't auto-fill with details from the previous user (that you just added). If anyone has that issue, a workaround is to add multiple email/password inputs (dummies) around the real-one, and hide them. In Chrome, this causes it to 'give up' and not try to auto-fill the fields.

gear54rus 11y ago

They removed the ability of a site maker to tell user if they should use password manager on their website. A much needed feature aka 'no, I do not care about password for your stupid site'.

aroch 11y ago
IMO, what's even more annoying are sites that detect whether you've used a password manager to fill your credentials and then 1) won't log you in, 2) frequently require you to clear your cookies and 3) sometimes make you change your password.
- dolske 11y ago
  Do you have examples of such sites? I'd be interested in seeing what they're doing, and how we can fix password manager to avoid that.
  - aroch 11y ago
    Either Uni. of Wisconsin or Baylor (at least the graduate application stuff) was one of them
hobarrera 11y ago
They also removed the ability of a site maker to tell the browser "no, this isn't the user's login form, it's where he inputs the username of somebody else".

riquito 11y ago

From the bug tracker https://bugzilla.mozilla.org/show_bug.cgi?id=956906#c100 https://bugzilla.mozilla.org/show_bug.cgi?id=956906#c100 Summary of the change, so people don't have to wade through a long discussion: - This change makes it so that `autocomplete=off` does not stop the Password Manager from working. Normal form autofill can be disabled as usual. - The password manager *always* prompts if it wants to save a password. Passwords are not saved without permission from the user. - We are the third browser to implement this change, after IE and Chrome. - This can be undone locally by flipping the `signon.storeWhenAutocompleteOff` pref (from about:config) off. - The rationale behind this change was the widespread abuse of the `autocomplete` attribute to prevent password saving where no prevention is required. This change gives users full control over password saving, without compromising on security (again, the user is always prompted).