Hacker News Reader

It is my understanding that the "autocomplete" event being referenced here, is after you 1 - ask the browser to autocomplete, 2 - the user is shown what will be shared, and accept to share it.

That would cover it (by comparison the scenario you think of would be crazy terrible).

View on HN

Well, I would expect those two actions to pre-fill the form data. I wouldn't expect them to also submit the form. I think that's the issue.

I think in that case it would be almost the same as a malicious site calling form.submit() after detecting in javascript that all of the fields have been filled out. It would have a slightly worse accuracy, though, since the user has not yet double checked that the form is correct. Does anyone know if there are laws related to this? I could definitely see it being illegal to automatically submit forms that result in financial transactions.

Look at the screenshot. The permissions dialog shows exactly what information is being submitted, and is labelled 'submit payment details'. No one should be misled.

Reply on news.ycombinator.com