There are a lot of answers on the subject (including some on StackOverflow), but none of them have recent or updated answers: I can't seem to find any documentation indicating which browsers support autocomplete="off". Can anyone point me in the right direction of a chart of form attributes and browser compatibility?
Password and Username caching on the browser allows an attacker, if by using sophisticated CSRF attack against the protected storage of the browser, or if by physical access to the victims machine to steal the victims credentials.
As a security consultant who wants to give the best practice and most secure solutions to his clients I want to make sure recommending AutoComplete="off" is the right solution to order the browser not to cache the user's credentials. For this I need to know if there are any browsers that don't apply this rule. If such case exists I need to recommend on another solution. Pentesters among us might want this information to R&D special attacks against such browsers, and users might be interested in such information to know what browsers not to use.