Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared environments such as Internet Coffee shops"

But disabling autocomplete attribute doesn't prevent browser from storing password when registering. How do I prevent users from storing password in their browser? (i.e. appearance of browser's popup "Do you want to save this password?" after registration or login)

Storage of password in user's browser may be dangerous because of trojans that can steal it. However auto-completing password may help from key loggers and men staying behind the shoulder. So should user be allowed to store password in it's browser?

share|improve this question
add comment

2 Answers

up vote 8 down vote accepted

There are different features at play here. Browsers offer to autocomplete text fields with previously entered values, which requires storing a history of the values previously entered in the same field. This history is stored in clear text and without any user feedback. A password field should never be subject to such history storage and autocompletion.

Browsers also have a distinct feature specifically targeted towards passwords. Passwords (that the web page declares as such) are only stored if the user explicitly answers “yes” to a prompt — most browsers ask some variation on “Do you want to save passwords? Yes / No / Never for this site”. Furthermore, the user can put a master password on password storage, which protects the passwords while the user is not using the computer.

In most cases, you should declare passwords as such, and allow them to be saved in the browser. This puts the responsibility of password security on the user, and as Tom Leek explains well, this is usually the right thing to do. If you don't do it, users are likely to write the password in a text file. If users use a shared or trojaned computer, they've lost anyway. If the user would consent to password storage, there's nothing to be gained by denying him that feature.

share|improve this answer
add comment

You cannot prevent the user from writing down his password on a stick-up note, and "hide" it under the keyboard. You cannot prevent the user from giving his password to his wife, friends, and colleagues. You cannot prevent the user from choosing as password the ID tattooed in the ear of his dog (there was even a commercial from a big French bank which promoted exactly that). For that matter, you cannot prevent users from typing their password on an Internet Coffee shop machine, which is already a bad idea, due to the threat of key loggers.

So I tend to say that password security is the responsibility of the user, and if he is intent on doing something stupid, you cannot truly prevent it.

Note that "auto-complete" is something a bit different, because it is about a Web browser filling data automatically regardless of the target page; normally, the "saved password" feature is tied in the browser to a specific page (or site), so it does not exhibit the privacy issues that auto-completed non-password field elements have (and which your auditing company rightly points out). Password saving is supposed to be handled with sufficient care by the browser itself.

Nevertheless, there seems to be some ways to prevent password storage from the page itself, or at least people who share your concern, possibly for administrative reasons which may or may not be rationally substantiated; see, for instance, this question on StackOverflow.

share|improve this answer
    
I would say to some degree it depends on what the password is actually for and how much security is needed for it. –  ewanm89 Feb 2 '12 at 16:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.