Currently, there is an HTML
input attribute called
autocomplete, which, when set to
off, disables autocomplete/autofill for that form or element.
Some banks seem to use this to prevent password managers from working. These days sites like Yahoo Mail seem to do it as well because they feel that password managers are unsafe.
A few weeks ago I implemented a feature in Firefox that gives the user an option to override this for username/password fields only (i.e. to disable the password manager). There now is a request that is asking for it to override
autocomplete=off by default. Quoting the issue:
This behavior is a concession to sites that think password managers are harmful and thus want to prevent them from being effective. In aggregate, I think those sites are generally wrong, and shouldn't have that much control over our behavior.
This makes sense to me, for similar reasons as the ones in this comment by BenB.
autocomplete=off has been abused a lot recently. Yahoo started using it for their login (including webmail and my.yahoo.com), which is why I stopped using Yahoo. Webmail apps - even some bigger providers - now use it, which was decidedly not the purpose. The admins are very self-righteous, and insist that the keep this "for security" because password saving "is unsafe".
They are misguided, because
- keyboard loggers exist and are widespread, probably more widespread than malware that can read Firefox password store.
- even simple attacks by the little nephew exist: Just look over the shoulder
- possibly most importantly, forcing users to re-enter their password every time practically forces them to use a simple password - easy to remember, easy to type, probably even used on multiple websites. This obviously lowers overall security dramatically and thus poses a danger to security.
So, autocomplete=off is actively harmful for security.
And a massive pain for end users, without a recurse for them apart from severing entire customer relationships.
There have been many workarounds (usually bookmarklet-based) that have been posted on the Internet. IE11 has already removed support for
The question is twofold:
- Is there any significant increase in security for a website when it uses
autocomplete=offon password fields? Or is it actually harmful to security as per BenB's comment?
- Should browsers allow this attribute by default and give this much control to the website? (This bit is subjective, feel free to not answer)
While my situation is specific to
autocomplete=off for username/password fields (the code only affects the password manager), I do welcome input on the broader aspect of disabling