For example: http://www.natwest.com/x-user.ashx?redirect=trusteer.interstitial.url&condition=trusteer.enabled2%3Dtrue

<input name="...." type="text" maxlength="10" id="ctl00_mainContent_LI5TABA_DBID_edit" autocomplete="off">

What are the security benefits of this, if any? Is it worth the sacrifice in usability?


The problem with autocomplete is that your browser stores information, which may be as sensitive as credit card info, and potentially anything stored in the browser could be grabbed by an attacker who compromises the browser.

Autocomplete="off" tells the browser it is not to store this information. Just a layer of safety which will require the user to type it in each time.

  • 2
    Miniquestion: is there a way for browsers to circumvent this? Its annoying when I use my own personal computer. – Dog eat cat world Aug 26 '11 at 20:14
  • 3
    @Dogeatcat Well behaved browsers should respect this attribute, but there are examples of plug-ins which can do this for you. Have a look at squarefree.com/bookmarklets/forms.html#remember_password – Rory Alsop Aug 26 '11 at 20:58
  • 2
    But it isn't recommended, from a security perspective – Rory Alsop Aug 26 '11 at 20:59
  • 2
    it depends. I can choose a better unique password for my online banking and tie it to my browser's master password. I'm more comfortable with this, as its not human to remember too many unique passwords. – Dog eat cat world Aug 26 '11 at 22:07

To add onto Rory's answer, imagine a public computer at a library. Typically you only need to enter 2 characters to get the autocomplete to trigger and finish a string. This greatly reduces complexity and enables a fast manual brute force on the users data.

  • 2
    Even if you enter it by hand it's still a public computer. I wouldn't be comfortable entering my details in either scenario. – RJFalconer Sep 5 '11 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.