Chrome Autofill doesn't respect autocomplete=off(bugs.chromium.org) |
Chrome Autofill doesn't respect autocomplete=off(bugs.chromium.org) |
I can imagine legitimate hypothetical use cases for it. I've just never seen a legitimate actual use case.
Edit: NIST says (in https://pages.nist.gov/800-63-FAQ/#q-b12):
> In SP 800-63B, NIST has not explicitly recommended the use of password managers, but recommends that verifiers permit the use of “paste” functionality so that the subscriber can use a password manager if desired.
I'll take their word over some rando app developer who doesn't want users to have a working 1Password setup.
The autocomplete attribute is very extensive.
https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...
I can give you a legitimate, actual use case where I had to develop a workaround: a page where an admin can change the password for a user. Under no circumstances would an autofill be desirable on that page, yet Chrome thinks it knows best.
Just don't give the input an "id=password" and Chrome won't throw your password into it.
It's just a label, the autofill is because it matches all the other sites where you do want Chrome to autofill your password.
> Autofill is a Privacy Violation here as it is retaining identity information about Clients when it MUST NOT.
Seems to make perfectly fine sense to me.
I was faced with this dilemma a few years ago. IIRC, the workaround was sketchy as hell. It was something like creating a password input field with the visibility set to none (and then chrome would autofill it, but it wouldn't be visible), and then the user enters their password into a regular text box, but you style the text box with CSS so that it appears as all discs. ~It was something like that, don't recall exactly.
This is one of the areas where browsers could really add some value. Make it easier to decide what to (not) remember. Make it easier to view and edit what's remembered. This is all a tedious pain at the moment, for no good reason I can see.
For me, Chrome has countless times clobbered the context-aware autofill (address fields, countries etc.) provided by the website with their useless autofill overlays.
I would much prefer if I could all together disable Chrome's suggestions in DOM input fields. Even when it has nothing to autofill, it sometimes puts something in there to take me to autofill settings or something.
At least this is one of the top complaints about my app that I get from the customer service folks that use it. I ended up somewhat fixing this by renaming the field, but sometimes it will still pop in something strange -- is Chrome picking up the word "Search" that appears as part of the user facing page content, even if the field ID is different?
edit: on login pages, beside those are some legitimate usecases.
I find it somewhat annoying that when I fill out my timecard at the end of the day autocomplete is on the hours field. I never want it to pop up my previous hours worked, that's annoying, I only want to enter the hours I worked today.
OP, I wish you’d written a blog post about what you see as relevant and interesting here, citing material from the bug and/or elsewhere — and then posted that to HN. (And, no, altering the post title wouldn’t help; your title is correct for the link you provided - thank you for adding Chrome!)
I don't want my password fields autocompleting; that sounds like an absolute usability nightmare. Conversely, I don't think browsers should even be able to stop me from pasting whatever I damn well please into a password field.
As to the other sentiments expressed here and in the main issue thread, I don't really disagree with Google's stance on autocomplete in regular form fields. I only really care about being able to remove invalid autocomplete entries that I may have mistakenly entered in the past (without simply deleting every entry).
Why? The usability is really good. This feature is invaluable if you use unique random passwords for every web site. Security has to be painless in order to work. If it's not, people will go back to using the same weak password for every site.
Letting web developers tell the browser what fields it should autofill is a fine idea. Unfortunately, they decided to use this power to turn off people's password managers for bullshit "security reasons". This is why we can't have nice things.
https://bugs.chromium.org/p/chromium/issues/detail?id=468153...
For example, I've accidentally reset multiple system passwords on a management interface where I could set the passwords/keys for several components when Chrome helpfully started autocompleting fields.
I'd much rather see a Firefox-style nag screen that notifies the user that the application in question has disabled their ability to autocomplete. If dumb developers disable autocomplete because of backwards "security" policies, showing a message saying "this website has told Chrome to disable autocomplete. If you wish to enable it, contact the website owners" or similar would be much more preferable to me. Maybe even leave the autocomplete behaviour in, but then put it behind a setting somewhere that's off by default.
All the good use cases for autocomplete=off have been ruined by all the terrible web developers and corporate managers out there.
I'll believe this when web sites stop disabling paste
But this also illustrates the fact that "useful" browser features can be trivially abused.
As for copy, I often find that the less common copy/paste commands (ctrl/shift+insert) still work when control+c/v have been intercepted. Sometimes adding an extra key also works (ctrl+shift+c). I theorize that this is because a lot of the times copy/paste is disabled, the incompetence of the people deciding on and building in the anti feature drips all the way down to the JS implementation.
I don't recall the service, but one employer of mine had both the suggestions for the MFA token, and as an added bonus, the browser would attempt to correct the "typo" in my username.
Sure. It's usually some CSS rule that can be easily turned off. These things are still extremely annoying though. We should not have to fix people's sites.
- Allowing a page to intercept a paste.
- If the page doesn't modify the DOM in response, then override it and actually paste the content.