undefined | Better HN

0 pointswatwut6y ago0 comments

Should developer be able to make it impossible to close browser or open 100 new tabs? No.

Should developer decide that fields are autocomplete off or green or show javascript warnings? Absolutely yes.

If user wish to change that, users thing. The browser/google has no business to be mediator here, second guess application they know nothing about and manipulate it.

The browser should be predictable, well specified and harmless. It should not force me to convert all ids into random strings just so that random data do not get prefilled in.

0 comments

michaelt6y ago

I've heard plenty of people on HN say password managers should ignore autocomplete=off and I agree with them. Because that setting is mostly applied by organisations like banks who incorrectly think they're making things more secure by doing so.

IMHO there are cases where autocomplete=off should be respected, and other times when it shouldn't be - it's certainly not as simple as saying always do or always don't respect it.

kalleboo6y ago

Password managers should ignore autocomplete=off in login screens, but not in administration screens where you’re editing other people’s credentials.

IMO the distinction could be made to not automatically fill when the autocomplete=off but instead add a button to let the user initiate it

rhizome6y ago

>not in administration screens where you’re editing other people’s credentials

    <input type="password" name="other-users-password" id="other-users-password">...

1 more reply

Rapzid6y ago

Well, all major browsers now ignore it on password fields so the browser ship has sailed on that one:

> This is the behavior in Firefox (since version 38), Google Chrome (since 34), and Internet Explorer (since version 11). - MDN

Osiris6y ago

I recently received a ticket from or security team to add "autocomplete=off" to all our password input fields.

I was pretty sure that it wouldn't do anything except make the security team feel better.

AJ0076y ago

* should a developer be able to hijack browser shortcuts, no. Should a developer be able to disable right click functionality, no.

j / k navigate · click thread line to collapse