Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There are a lot of answers on the subject (including some on StackOverflow), but none of them have recent or updated answers: I can't seem to find any documentation indicating which browsers support autocomplete="off". Can anyone point me in the right direction of a chart of form attributes and browser compatibility?

Password and Username caching on the browser allows an attacker, if by using sophisticated CSRF attack against the protected storage of the browser, or if by physical access to the victims machine to steal the victims credentials.

As a security consultant who wants to give the best practice and most secure solutions to his clients I want to make sure recommending AutoComplete="off" is the right solution to order the browser not to cache the user's credentials. For this I need to know if there are any browsers that don't apply this rule. If such case exists I need to recommend on another solution. Pentesters among us might want this information to R&D special attacks against such browsers, and users might be interested in such information to know what browsers not to use.

share|improve this question
7  
Is this a security question? If so, state your security problem. If not, this is the wrong forum. –  GdD Oct 29 '12 at 11:57
    
Check my question again. I think I made it clear enough. –  Boaz Tirosh Oct 30 '12 at 7:53
add comment

1 Answer 1

Exact duplicate of SO question (which is more relevant than here): http://stackoverflow.com/questions/3868299/is-autocomplete-off-compatible-with-all-modern-browsers

Basically, most modern browsers attempt to respect it, though it would be trivial to write an javascript extension to ignore/disable it. E.g., with jQuery library they could do something like add the following javascript to every page:

$(document).ready(function() {
 $(":input").attr('autocomplete', 'on');
}

which would override the autocomplete settings of the website. Basically, your best bet is to set autocomplete='off' and additionally set a policy to tell users to never have the browser remember the password for this website.

share|improve this answer
    
As you can see, I mentioned in my question that "There are a lot of answers on the subject (including some on StackOverflow), but none of them have recent or updated answers". I did give a thorough explanation why this is a security issue, and why it is relevant to this community. If you don't agree you are welcome to do so on the comments to my question. –  Boaz Tirosh Oct 30 '12 at 11:34
    
I am not looking for a way to avoid AutoComplete property, I don't have any control on the user machine, I want to know only if there are browsers that don't respect this property. Making your remark on jQuery and javascript extensions redundant. Also, since I'm looking for a time-proof answer: I am asking if there is a KB that can answer that, so this question won't have to be asked again. –  Boaz Tirosh Oct 30 '12 at 11:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.