The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared environments such as Internet Coffee shops"
But disabling autocomplete attribute doesn't prevent browser from storing password when registering. How do I prevent users from storing password in their browser? (i.e. appearance of browser's popup "Do you want to save this password?" after registration or login)
Storage of password in user's browser may be dangerous because of trojans that can steal it. However auto-completing password may help from key loggers and men staying behind the shoulder. So should user be allowed to store password in it's browser?