Hacker News Reader

Comment by pilif | Hacker News Reader

It causes spec-compliant password managers to not work.

Unfortunately, disabling autocomplete for password fields is an often used form of security-theatre

Combine that with sites attempting to block pasting in a "complex, secure" password and I start to see Google's point here, bad as I don't want to. How "auth" is handled, at almost every layer, seems about as badly broken as "security" in the U.S. banking system.

Fortunately, Firefox gives me dom.event.clipboardevents.enabled so I at least need not worry about my workaround being broken.

Here's the tricky thing and I don't have a solution that doesn't get abused. I hate that lots of bank do this but I also have a use case for password autocomplete=off. We operate in an industry where shared computer access is very common and the risk of users saving password in browser is real and too high.

As I said don't know what the answer is. I definitely want someone using password manager be able to use them. Using a password manager is a conscious choice with setups involved. Browser's default autocomplete is often not. I don't know how to separate these two out.

Isn’t it on the people administering those systems to disable autofill on their side?

In theory it is. But for most customers (who are small) there's almost no IT department and the average computer literacy is lower than you might think (though improving) so the risk is there. Except for that situation I would happily leave them autofill/save password.

You could, I dunno, use the tools specifically provided to disable saving passwords in environments where that's undesirable:

https://thycotic.com/company/blog/2013/09/09/securing-web-br...

kiosk mode? Firefox has a great extension for this.

Ok, but how is that abuse? And if autocomplete=off is part of the html standard, how are the password managers spec compliant if they can't deal with it? Are people doing this just to annoy users who prefer password managers?

>Are people doing this just to annoy users who prefer password managers?

People are doing it because they don't understand password managers, and think blocking them makes people more secure. They believe that if a password is in a manager, that password is less secure than if that password was purely in the user's head.

If a bug in the password manager leaked the password to your bank to a third party, many users wouldn't want to pay for any associated costs/expenses when a bad guy steals their money.

Yet the bank also doesn't want to take on security audits for code entirely outside their control.

Then banks should recommend a good password manager. It's on them to make their users happy after all.

One part of that is a proper risk analysis. Password reuse and weak passwords are much bigger risks than a rouge autocompleter.

I consider that similar to a bug in the browser or the operating system. Should the bank require that I only use specific browsers or operating systems? In fact any program I install on my computer could have a vulnerability, or be malicious and thus lead to my password being stolen. Should the bank require that I not install any programs except ones they specifically permit?

The bank should also consider which is more frequent: user account compromises due to weak/reused passwords, or user account compromises due to password manager bugs.

Then only ignore autocomplete=off for forms that have password fields.

Sure, stupid devs can still work around that too, but so can they work around the current ingore-always behavior.

Reply on news.ycombinator.com