Should user be allowed to save password in browser?

Question

The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared environments such as Internet Coffee shops"

But disabling autocomplete attribute doesn't prevent browser from storing password when registering. How do I prevent users from storing password in their browser? (i.e. appearance of browser's popup "Do you want to save this password?" after registration or login)

Storage of password in user's browser may be dangerous because of trojans that can steal it. However auto-completing password may help from key loggers and men staying behind the shoulder. So should user be allowed to store password in it's browser?

Answer 1

There are different features at play here. Browsers offer to autocomplete text fields with previously entered values, which requires storing a history of the values previously entered in the same field. This history is stored in clear text and without any user feedback. A password field should never be subject to such history storage and autocompletion.

Browsers also have a distinct feature specifically targeted towards passwords. Passwords (that the web page declares as such) are only stored if the user explicitly answers “yes” to a prompt — most browsers ask some variation on “Do you want to save passwords? Yes / No / Never for this site”. Furthermore, the user can put a master password on password storage, which protects the passwords while the user is not using the computer.

In most cases, you should declare passwords as such, and allow them to be saved in the browser. This puts the responsibility of password security on the user, and as Tom Leek explains well, this is usually the right thing to do. If you don't do it, users are likely to write the password in a text file. If users use a shared or trojaned computer, they've lost anyway. If the user would consent to password storage, there's nothing to be gained by denying him that feature.

Answer 2

You cannot prevent the user from writing down his password on a stick-up note, and "hide" it under the keyboard. You cannot prevent the user from giving his password to his wife, friends, and colleagues. You cannot prevent the user from choosing as password the ID tattooed in the ear of his dog (there was even a commercial from a big French bank which promoted exactly that). For that matter, you cannot prevent users from typing their password on an Internet Coffee shop machine, which is already a bad idea, due to the threat of key loggers.

So I tend to say that password security is the responsibility of the user, and if he is intent on doing something stupid, you cannot truly prevent it.

Note that "auto-complete" is something a bit different, because it is about a Web browser filling data automatically regardless of the target page; normally, the "saved password" feature is tied in the browser to a specific page (or site), so it does not exhibit the privacy issues that auto-completed non-password field elements have (and which your auditing company rightly points out). Password saving is supposed to be handled with sufficient care by the browser itself.

Nevertheless, there seems to be some ways to prevent password storage from the page itself, or at least people who share your concern, possibly for administrative reasons which may or may not be rationally substantiated; see, for instance, this question on StackOverflow.