Hacker News Reader

Comment by geuis | Hacker News Reader

Oh I am sure there are good uses for this but the code sample scares the pants off me. Never ever evah do the following:

    form.addEventListener('autocomplete', function(){
      form.submit();
    });

This does not give the user any time to review or update the information that the browser autocompletes.

Always show the user what information is being sent, always give them an option to change it.

View on HN

It is my understanding that the "autocomplete" event being referenced here, is after you 1 - ask the browser to autocomplete, 2 - the user is shown what will be shared, and accept to share it.

That would cover it (by comparison the scenario you think of would be crazy terrible).

Well, I would expect those two actions to pre-fill the form data. I wouldn't expect them to also submit the form. I think that's the issue.

I think in that case it would be almost the same as a malicious site calling form.submit() after detecting in javascript that all of the fields have been filled out. It would have a slightly worse accuracy, though, since the user has not yet double checked that the form is correct. Does anyone know if there are laws related to this? I could definitely see it being illegal to automatically submit forms that result in financial transactions.

Look at the screenshot. The permissions dialog shows exactly what information is being submitted, and is labelled 'submit payment details'. No one should be misled.

As others have noted, Chrome does show the data that will be sent in a modal dialog until the user hits "submit". Calling form.submit() should send the user to a confirmation page which also shows parts of the data back to the user, and allows them to confirm the purchase.

You wouldn't even need form.submit() this could be accomplished just through url encoding and ajax. This is exactly why this concerns me too, but it sounds like it will prompt the end user when the api call is made (similar to geolocate apis).

As long as the data is NOT filled in automatically on call and the user is prompted, then this feature SHOULD be safe to use.

The UI provides a review before completion (which triggers the autocomplete event), and the feature is expressly designed to be used with hidden forms so that no actual form interaction is required.

Reply on news.ycombinator.com