0

Is there anything a website code do to prevent any browser from remembering your password? I am aware that from browser's options, users can change setting to ask to remember password or not. But can website have code that disables this feature so that when you visit the website login page and log in, whatever setting your browser may have is now not gonna ask to remember it? My opinion is that you can not really do that from the website like your websites client side javascript code. I am wondering if there is some sort of standard out there that allows this feature.

  • 3
    Even if such a feature existed, you should never trust it as the client is unsecured and can cheat. – Neil Smithline Oct 8 '15 at 20:05
  • For some reason, some security team thinks, allowing password managers to remember your password is your web application's fault. I do not know if I agree since you cannot do anything about it as far as I can tell. – DoodleKana Oct 8 '15 at 20:10
  • 1
    Related: stackoverflow.com/questions/3868299/… – bretik Oct 8 '15 at 20:37
  • @bretik This information is outdated. Auto complete is NOT a password manager. Modern browsers do not remember password fields, but password managers built into modern browsers do if another field is called email, name, username, or one of many other identifiers. – Robert Mennell Oct 8 '15 at 21:34
  • 1
    For some reason, some security team thinks, allowing password managers to remember your password is your web application's fault - that means it's time to get a new security team. They seem to be missing the fundamental security concept that you have no control over the client. – Neil Smithline Oct 8 '15 at 21:44
5

So first a little bit of information:

Auto Complete is not filling in the login form, a password manager is. Modern browsers will NEVER have auto complete remember a login form!

Password managers are NOT a security flaw or point of attack. An unprotected/poorly designed system, bad users, and bad policies are.

Most browsers these days implement a password manager into their browser(NOT auto complete) that keeps things in a safe and secure location(for google chrome, it's actually stored in your google account cloud). In google chrome, firefox, and edge you can disable the password manager and it will not affect auto complete. This is because auto complete and password manager are two separate sub programs running in the browser. autocomplete=off on a form does not say "Don't Fill In A Form", it says "Don't Remember This Form". However a browser will still probably fill in a login area and ask to remember it because password managers are not auto complete, and thusly ignore this. If the password manager is turned off and you go to a login page, it will not automatically fill in the form even if auto complete is turned on. This is because of the way most modern browsers implement auto complete and their built in password managers. What does this mean? Well it means you, as a web developer, have NO CONTROL over a users browser program itself, just the web page. As such you cannot prevent the password manager form remembering the password, just the same as you can't prevent the user from writing the password on a sticky note or in the mud.

So what can you do to prevent this? Nothing. That's not a bad thing though. You just need to build your website, applications, and services as secure as possible so that if something gets compromised, as little damage as possible happens to your service.

If a security expert tells you a password manager is a security flaw, ask them how they manage their randomly generated, routinely updated secure login credentials and private keys. Then find a new security expert!!!

That being said, a password manager is not something to be feared. It can actually be a GOD send for storing randomly generated, routinely updated enterprise level passwords.

  • Thanks for the answer. I verified that I was not going crazy. I will follow up with them and see exactly why they thought it was a vulnerability of the application. – DoodleKana Oct 8 '15 at 21:53
  • 1
    Good. If a security expert ever tells you a user is a vulnerability, you should say duh. – Robert Mennell Oct 8 '15 at 22:06
  • Well, it was not so obvious first. It looked like as if they are inferring that password managers store passwords into cookies therefore someone can steal that sensitive information from your cookie. But they had screenshot of chrome's password manager show password selected saying hey your website is allowing this to happen. – DoodleKana Oct 8 '15 at 22:28
  • Well glad I helped clear it up. – Robert Mennell Oct 8 '15 at 22:30
3

There was once an autocomplete=off attribute on forms, but this attribute is deliberately ignored in most browsers (Chrome, Firefox, IE) for a while, see The autocomplete attribute and login fields. So the answer is probably that the website has no control if these information are saved or not.

  • The autocomplete is off. But chrome and firefox do not seem to care. It will let you save password in its password manager. – DoodleKana Oct 8 '15 at 20:02
  • You can do things like prevent paste from working, but this is considered bad design by most people. The real question is why does your security team think this is even relevant? If they're worried about account compromises, they should be implementing 2 factor auth, not depending on browser features. – Scott C Wilson Oct 8 '15 at 20:26
  • From bretik's comment, browsers are ignoring this feature going forward. I just witnessed that 2 browsers I tried ignore that feature completely. So, it sounds like wrong assumption the security team is making. – DoodleKana Oct 8 '15 at 20:46
  • @DoodleKana: I would suggest that you simply follow the link I have in my answer which gets into more detail which browser ignore the attribute. And with "most browsers" I mention in my answer I really mean the majority, which includes Chrome, Firefox and current IE. – Steffen Ullrich Oct 8 '15 at 20:51
  • Yes, I read it and looked at @bretik stackoverflow.com/questions/3868299/… link. So other than browsers ignoring it there is really no way to disable it from code it seems. – DoodleKana Oct 8 '15 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.