undefined | Better HN

0 pointsklmr6y ago0 comments

Unfortunately a few developers are morons who misuse features, and browser vendors try hard to work around them. Case in point, lots of websites used to put `autocomplete="off"` on password boxes, which breaks some password managers. IIRC that’s why Chrome (and other browsers) decided to sometimes ignore the `autocomplete` attribute in the first place. Of course that doesn’t justify ignoring it completely (just for password fields) but maybe a similar reason is at play.

0 comments

onli6y ago

Exactly. Autocomplete=off gets misused. For example, there was a browsergame I played where because of idiotic "security considerations" autocomplete=off got applied to the login screen. At that time for me that meant typing in the password manually, thus picking a bad password.

So it's a good thing in that situation when the browser ignores the attribute.

1 more reply

erichurkman6y ago

Now they need to ban intercepting/blocking `onpaste` in form fields.

antisemiotic6y ago

This has the added benefit of disabling local password managers like PasswordSafe. Might as well throw in some stupid password policy (like maximum password length, or banning some special characters but not explaining which) to make sure stubborn users won't use a secure password even if they're willing to type it in every time.

vorpalhex6y ago

As an fyi, you can disable the onpaste event in the dev console. Obviously doesn't fix the actual problem but at least helps retyping your email...

TurningCanadian6y ago

That was even mandated for all password fields by the PCI scans required for any sites accepting credit cards.

j / k navigate · click thread line to collapse