1

Scenario:

Alice uses my website on her own computer and sometimes also on a computer that Mallory also has access to. Alice likes using the password manager built in to the browser. She is aware that she needs to be more careful on computers that others also use.

Is there a way that I can provide a button to forget Alice's login details after she has finished (both username and password)? If she doesn't do this, Mallory has the ability to retrieve her login details.

There are thousands of Alices using my website, so I'm going to assume that trying to educate them all is a losing battle. I'm looking for a solution that works with human behaviour, not against it.

  • Is Mallory's machine treated as trusted while the user logs in (no keylogger etc.)? – jrtapsell Jun 17 '18 at 2:03
  • @jrtapsell Yes, Mallory is the user, not the machine. Let's say Mallory has access only after Alice has used it. – CJ Dennis Jun 17 '18 at 5:22
  • I think that you're looking for what websites do when you select "trusted device"? – David Kamer Jun 17 '18 at 5:23
  • 2
    Is it about a password manager or about active sessions? Password managers have a clear delete function in common browsers. – allo Jul 17 '18 at 11:34
0

If I'm not mistaken, the browser only saves the information if it is there when either the AJAX request is sent or the page changes.

Now I'm going to get slightly technical given that this isn't StackOverflow, but I won't go into too many details as you should post it there if you have code related questions, but given what you want the process could go like this for a state handling library like React:

  1. the user presses submit.
  2. you delay the execution of the page change/login/ajax request.
  3. you save the information to some state (or a variable).
  4. you set the values of the boxes to generic "user" and "****".
  5. You send the request and log in the user.

I'm not exactly certain if this will work with every browser, but I have noticed that websites tend to do something similar quite often. I will admit that this is highly dependent on the browser, but it always will be and I honestly don't think that browsers are smart enough to know the difference, and if they are, just place the submit button outside of the form (if preventDefault doesn't do the trick first).

  • I don't think that would allow the browser to save the password on Alice's browser either. Alice wants the previous password automatically filled in unless she has deleted it. – CJ Dennis Jun 17 '18 at 5:24
  • see my above comment about how websites ask if it is a secure or public device. You would just submit directly if it were a secure device and avoid my provided steps with a simple conditional set by a checkbox if that is the case, or avoid the (imo insecure) browser storage altogether and use something like a jwt if it is a secure device. – David Kamer Jun 17 '18 at 5:30
  • basically you would avoid education and bring it down to a simple question about whether it is their device or someone else's/a public device. – David Kamer Jun 17 '18 at 5:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.