Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 7 down vote favorite
1

For example: http://www.natwest.com/x-user.ashx?redirect=trusteer.interstitial.url&condition=trusteer.enabled2%3Dtrue

<input name="...." type="text" maxlength="10" id="ctl00_mainContent_LI5TABA_DBID_edit" autocomplete="off">

What are the security benefits of this, if any? Is it worth the sacrifice in usability?

share|improve this question

2 Answers

up vote 13 down vote accepted

The problem with autocomplete is that your browser stores information, which may be as sensitive as credit card info, and potentially anything stored in the browser could be grabbed by an attacker who compromises the browser.

Autocomplete="off" tells the browser it is not to store this information. Just a layer of safety which will require the user to type it in each time.

share|improve this answer
2  
Miniquestion: is there a way for browsers to circumvent this? Its annoying when I use my own personal computer. – Dog eat cat world Aug 26 '11 at 20:14
3  
@Dogeatcat Well behaved browsers should respect this attribute, but there are examples of plug-ins which can do this for you. Have a look at squarefree.com/bookmarklets/forms.html#remember_password – Rory Alsop♦ Aug 26 '11 at 20:58
2  
But it isn't recommended, from a security perspective – Rory Alsop♦ Aug 26 '11 at 20:59
2  
it depends. I can choose a better unique password for my online banking and tie it to my browser's master password. I'm more comfortable with this, as its not human to remember too many unique passwords. – Dog eat cat world Aug 26 '11 at 22:07
up vote 7 down vote

To add onto Rory's answer, imagine a public computer at a library. Typically you only need to enter 2 characters to get the autocomplete to trigger and finish a string. This greatly reduces complexity and enables a fast manual brute force on the users data.

share|improve this answer
2  
Even if you enter it by hand it's still a public computer. I wouldn't be comfortable entering my details in either scenario. – RJFalconer Sep 5 '11 at 13:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.