Hacker News Reader

Comment by dubcanada | Hacker News Reader

Anyone have any insight on why they removed autocomplete from username & password fields?

Presumably this: https://bugzilla.mozilla.org/show_bug.cgi?id=956906

I think it means that sites can't overrule the browser's inclination to store passwords. The argument seems to be the browser makers will store passwords safely.

> The argument seems to be the browser makers will store passwords safely.

Not quite. Unless you set a master password, whoever owns your computer will own the passwords stored by your browser.

The argument is that disabling autocomplete makes users choose poor passwords that are easy to remember, or write passwords down somewhere, which is at least as bad as having passwords stored in your browser profile.

writing passwords down somewhere, such as on PAPER, is not a particularly bad idea unless you keep the paper by your computer.

There are some valid use-cases, e.g. in web-apps with an user-admin section. It's useful that when adding user 2 (or N) it won't auto-fill with details from the previous user (that you just added).

If anyone has that issue, a workaround is to add multiple email/password inputs (dummies) around the real-one, and hide them. In Chrome, this causes it to 'give up' and not try to auto-fill the fields.

They removed the ability of a site maker to tell user if they should use password manager on their website. A much needed feature aka 'no, I do not care about password for your stupid site'.

IMO, what's even more annoying are sites that detect whether you've used a password manager to fill your credentials and then 1) won't log you in, 2) frequently require you to clear your cookies and 3) sometimes make you change your password.

Do you have examples of such sites? I'd be interested in seeing what they're doing, and how we can fix password manager to avoid that.

Either Uni. of Wisconsin or Baylor (at least the graduate application stuff) was one of them

They also removed the ability of a site maker to tell the browser "no, this isn't the user's login form, it's where he inputs the username of somebody else".

From the bug tracker https://bugzilla.mozilla.org/show_bug.cgi?id=956906#c100

Summary of the change, so people don't have to wade through a long discussion:

  - This change makes it so that `autocomplete=off` does not stop the Password Manager from working. Normal form autofill can be disabled as usual.
  - The password manager *always* prompts if it wants to save a password. Passwords are not saved without permission from the user.
  - We are the third browser to implement this change, after IE and Chrome.
  - This can be undone locally by flipping the `signon.storeWhenAutocompleteOff` pref (from about:config) off.
  - The rationale behind this change was the widespread abuse of the `autocomplete` attribute to prevent password saving where no prevention is required. This change gives users full control over password saving, without compromising on security (again, the user is always prompted).

Reply on news.ycombinator.com