If not specified, browser by default suggests previously entered form fields and to prevent it autocomplete is the option. But I checked with the latest firefox and found that even if not specified "Autocomplete" to "Off" browser does not suggest the previously entered passwords for password field. Whereas for username it does suggests. Below is a sample code.

<form action="/action_page.php">
  First name:<input type="text" name="fname"><br>
  Last name: <input type="text" name="lname"><br>
  Password: <input type="password" name="pass"><br>
  E-mail: <input type="email" name="email"><br>
  <input type="submit">

Auto-complete or Auto-fill data skimming is a known security issue. The latest firefox and Chrome browser by default now turn off auto-fill HTML features. However, for existing browser that already turn on auto-fill, subsequent update will not turn off the auto-fill, if the user already turn them on.

At the moment, you can check out firefox auto form fill documentation to check out the auto-fill behaviour, i.e. you need to type letter to make the browser call out the matching drop down saved form data. Similar implementation also used by Chrome.

Since this mechanism is not part of HTML form, so it is difficult to inject a context character and control the selection. Nevertheless, those who want to do data skimming will keep trying. So there is no guarantee that this browser mitigation mechanism will prevent auto-fill data hijack indefinitely.

Not the answer you're looking for? Browse other questions tagged or ask your own question.