8 ms·

Chrome Autofill doesn't respect autocomplete=off

dmitrygr 5y ago
> Web applications developer KNOW THE CONTEXT OF THEIR USE CASE I'll believe this when web sites stop disabling paste
- postalrat 5y ago
  Another thing browsers should not allow the page to override.
  - olliej 5y ago
    You need it for google docs, etc to intercept paste events and do the right thing from the perspective of a document editor. But this also illustrates the fact that "useful" browser features can be trivially abused.
    - kstrauser 5y ago
      That's an interesting point. I could see the feature looking like: - Allowing a page to intercept a paste. - If the page doesn't modify the DOM in response, then override it and actually paste the content.
      - jaywalk 5y ago
        Still trivial to bypass.
        kstrauser 5y ago
        Maybe, but it might block the common case of "well intentioned developer breaks the built-in functionality without realizing it".
        jaywalk 5y ago
        Is that really a common case when paste is disabled? I can't recall ever coming across it where it wasn't obvious that it was intentional.
        kstrauser 5y ago
        That may be true. Maybe instead we could have a menu like - Copy - Paste - No, really, paste the darn text
- jesboat 5y ago
  There's an extension called "Don't fuck with paste" which disables intercepting paste, not sure how. You have to remember to add sites that you do want to intercept paste (mostly rich text apps) to the whitelist.
- matheusmoreira 5y ago
  And copy. And right click. And text selection.
  - jeroenhd 5y ago
    Firefox ignores the right click overrides if you hold down shift. I'm not sure about text selection, but there's probably a way to do that as well. I haven't found a bypass on Chrome yet, though. As for copy, I often find that the less common copy/paste commands (ctrl/shift+insert) still work when control+c/v have been intercepted. Sometimes adding an extra key also works (ctrl+shift+c). I theorize that this is because a lot of the times copy/paste is disabled, the incompetence of the people deciding on and building in the anti feature drips all the way down to the JS implementation.
    - matheusmoreira 5y ago
      > I'm not sure about text selection, but there's probably a way to do that as well Sure. It's usually some CSS rule that can be easily turned off. These things are still extremely annoying though. We should not have to fix people's sites.
judge2020 5y ago
Yes, I should have to read out and type my 30 character password from my password manager when sites use `autocomplete=off` and disable pasting on the confirm password field (at least for when I accidentally leave clipboard events on).
- weird-eye-issue 5y ago
  I use LastPass with over 600 passwords and have never had this issue...
  - merb 5y ago
    well also most password managers disable the native autofill, i.e. 1password x disables native autofill in chrome/firefox
  - kayodelycaon 5y ago
    LastPass likely ignores autocomplete=off (like almost everything else). Therefore, you would never have an issue with autocomplete=off preventing autocomplete.
    - weird-eye-issue 5y ago
      Well that is kind of my point: It doesn't make sense to complain this would break password managers if they don't even use autofill in the first place.
  - cuddlybacon 5y ago
    My works's SSO tries to block autocomplete. Before Chrome started ignoring it, a lot of people switched to Safari over the issue.
- deleted 5y ago
  [deleted]
syntheticnature 5y ago
I don't respect it, either.
kstrauser 5y ago
Good. I have never, not once, seen autocomplete=off where it actually made sense, except in the minds of a developer who erroneously thinks it's a good idea to block password managers. I can imagine legitimate hypothetical use cases for it. I've just never seen a legitimate actual use case. Edit: NIST says (in https://pages.nist.gov/800-63-FAQ/#q-b12 https://pages.nist.gov/800-63-FAQ/#q-b12): > In SP 800-63B, NIST has not explicitly recommended the use of password managers, but recommends that verifiers permit the use of “paste” functionality so that the subscriber can use a password manager if desired. I'll take their word over some rando app developer who doesn't want users to have a working 1Password setup.
- mark242 5y ago
  Two-factor auth selecting focus and suddenly seeing a dropdown of old, worthless 6-digit numbers comes to mind.
  - kstrauser 5y ago
    I've never seen that in the wild.
    - banana_giraffe 5y ago
      Consider yourself lucky. I don't recall the service, but one employer of mine had both the suggestions for the MFA token, and as an added bonus, the browser would attempt to correct the "typo" in my username.
  - scrollaway 5y ago
    There is `autocomplete="one-time-code"` for this. The autocomplete attribute is very extensive. https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...
- salzig 5y ago
  hell yes. But even worse are customers that want exactly this for "security reasons". edit: on login pages, beside those are some legitimate usecases.
floatingatoll 5y ago
This is a low quality post; this linked bug appears to have thousands of comments, most of them are advocacy repetition, and I don’t know whether OP is trying to point out the technical workaround linked, advocating for this to be changed, or advocating against this being changed. OP, I wish you’d written a blog post about what you see as relevant and interesting here, citing material from the bug and/or elsewhere — and then posted that to HN. (And, no, altering the post title wouldn’t help; your title is correct for the link you provided - thank you for adding Chrome!)
Semiapies 5y ago
It hasn't since at least 2015. And good. https://bugs.chromium.org/p/chromium/issues/detail?id=468153#c164 https://bugs.chromium.org/p/chromium/issues/detail?id=468153...
- jeroenhd 5y ago
  I don't think that's a good thing. Perhaps it's better than the alternative (which is that web developers abuse the hell out of the feature), but there's been plenty of cases where autocomplete has annoyed the hell out of me. For example, I've accidentally reset multiple system passwords on a management interface where I could set the passwords/keys for several components when Chrome helpfully started autocompleting fields. I'd much rather see a Firefox-style nag screen that notifies the user that the application in question has disabled their ability to autocomplete. If dumb developers disable autocomplete because of backwards "security" policies, showing a message saying "this website has told Chrome to disable autocomplete. If you wish to enable it, contact the website owners" or similar would be much more preferable to me. Maybe even leave the autocomplete behaviour in, but then put it behind a setting somewhere that's off by default. All the good use cases for autocomplete=off have been ruined by all the terrible web developers and corporate managers out there.
dang 5y ago
Chrome does not respect autocomplete=off (2018) - https://news.ycombinator.com/item?id=26309919 https://news.ycombinator.com/item?id=26309919 - March 2021 (74 comments)
pixelbath 5y ago
Why is every top-level comment equating autocomplete with the ability to paste a password? Those are two explicitly different use cases, and one should not affect the other. I don't want my password fields autocompleting; that sounds like an absolute usability nightmare. Conversely, I don't think browsers should even be able to stop me from pasting whatever I damn well please into a password field. As to the other sentiments expressed here and in the main issue thread, I don't really disagree with Google's stance on autocomplete in regular form fields. I only really care about being able to remove invalid autocomplete entries that I may have mistakenly entered in the past (without simply deleting every entry).
- matheusmoreira 5y ago
  > I don't want my password fields autocompleting; that sounds like an absolute usability nightmare. Why? The usability is really good. This feature is invaluable if you use unique random passwords for every web site. Security has to be painless in order to work. If it's not, people will go back to using the same weak password for every site. Letting web developers tell the browser what fields it should autofill is a fine idea. Unfortunately, they decided to use this power to turn off people's password managers for bullshit "security reasons". This is why we can't have nice things.

> Web applications developer KNOW THE CONTEXT OF THEIR USE CASE I'll believe this when web sites stop disabling paste

postalrat 5y ago
Another thing browsers should not allow the page to override.
- olliej 5y ago
  You need it for google docs, etc to intercept paste events and do the right thing from the perspective of a document editor. But this also illustrates the fact that "useful" browser features can be trivially abused.
  - kstrauser 5y ago
    That's an interesting point. I could see the feature looking like: - Allowing a page to intercept a paste. - If the page doesn't modify the DOM in response, then override it and actually paste the content.
    - jaywalk 5y ago
      Still trivial to bypass.
      - kstrauser 5y ago
        Maybe, but it might block the common case of "well intentioned developer breaks the built-in functionality without realizing it".
        jaywalk 5y ago
        Is that really a common case when paste is disabled? I can't recall ever coming across it where it wasn't obvious that it was intentional.
        kstrauser 5y ago
        That may be true. Maybe instead we could have a menu like - Copy - Paste - No, really, paste the darn text
jesboat 5y ago
There's an extension called "Don't fuck with paste" which disables intercepting paste, not sure how. You have to remember to add sites that you do want to intercept paste (mostly rich text apps) to the whitelist.
matheusmoreira 5y ago
And copy. And right click. And text selection.
- jeroenhd 5y ago
  Firefox ignores the right click overrides if you hold down shift. I'm not sure about text selection, but there's probably a way to do that as well. I haven't found a bypass on Chrome yet, though. As for copy, I often find that the less common copy/paste commands (ctrl/shift+insert) still work when control+c/v have been intercepted. Sometimes adding an extra key also works (ctrl+shift+c). I theorize that this is because a lot of the times copy/paste is disabled, the incompetence of the people deciding on and building in the anti feature drips all the way down to the JS implementation.
  - matheusmoreira 5y ago
    > I'm not sure about text selection, but there's probably a way to do that as well Sure. It's usually some CSS rule that can be easily turned off. These things are still extremely annoying though. We should not have to fix people's sites.

judge2020 5y ago

Yes, I should have to read out and type my 30 character password from my password manager when sites use `autocomplete=off` and disable pasting on the confirm password field (at least for when I accidentally leave clipboard events on).

weird-eye-issue 5y ago
I use LastPass with over 600 passwords and have never had this issue...
- merb 5y ago
  well also most password managers disable the native autofill, i.e. 1password x disables native autofill in chrome/firefox
- kayodelycaon 5y ago
  LastPass likely ignores autocomplete=off (like almost everything else). Therefore, you would never have an issue with autocomplete=off preventing autocomplete.
  - weird-eye-issue 5y ago
    Well that is kind of my point: It doesn't make sense to complain this would break password managers if they don't even use autofill in the first place.
- cuddlybacon 5y ago
  My works's SSO tries to block autocomplete. Before Chrome started ignoring it, a lot of people switched to Safari over the issue.
deleted 5y ago
[deleted]

syntheticnature 5y ago

I don't respect it, either.

kstrauser 5y ago

Good. I have never, not once, seen autocomplete=off where it actually made sense, except in the minds of a developer who erroneously thinks it's a good idea to block password managers. I can imagine legitimate hypothetical use cases for it. I've just never seen a legitimate actual use case. Edit: NIST says (in https://pages.nist.gov/800-63-FAQ/#q-b12 https://pages.nist.gov/800-63-FAQ/#q-b12): > In SP 800-63B, NIST has not explicitly recommended the use of password managers, but recommends that verifiers permit the use of “paste” functionality so that the subscriber can use a password manager if desired. I'll take their word over some rando app developer who doesn't want users to have a working 1Password setup.

mark242 5y ago
Two-factor auth selecting focus and suddenly seeing a dropdown of old, worthless 6-digit numbers comes to mind.
- kstrauser 5y ago
  I've never seen that in the wild.
  - banana_giraffe 5y ago
    Consider yourself lucky. I don't recall the service, but one employer of mine had both the suggestions for the MFA token, and as an added bonus, the browser would attempt to correct the "typo" in my username.
- scrollaway 5y ago
  There is `autocomplete="one-time-code"` for this. The autocomplete attribute is very extensive. https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...
salzig 5y ago
hell yes. But even worse are customers that want exactly this for "security reasons". edit: on login pages, beside those are some legitimate usecases.

floatingatoll 5y ago

This is a low quality post; this linked bug appears to have thousands of comments, most of them are advocacy repetition, and I don’t know whether OP is trying to point out the technical workaround linked, advocating for this to be changed, or advocating against this being changed. OP, I wish you’d written a blog post about what you see as relevant and interesting here, citing material from the bug and/or elsewhere — and then posted that to HN. (And, no, altering the post title wouldn’t help; your title is correct for the link you provided - thank you for adding Chrome!)

Semiapies 5y ago

It hasn't since at least 2015. And good. https://bugs.chromium.org/p/chromium/issues/detail?id=468153#c164 https://bugs.chromium.org/p/chromium/issues/detail?id=468153...

jeroenhd 5y ago
I don't think that's a good thing. Perhaps it's better than the alternative (which is that web developers abuse the hell out of the feature), but there's been plenty of cases where autocomplete has annoyed the hell out of me. For example, I've accidentally reset multiple system passwords on a management interface where I could set the passwords/keys for several components when Chrome helpfully started autocompleting fields. I'd much rather see a Firefox-style nag screen that notifies the user that the application in question has disabled their ability to autocomplete. If dumb developers disable autocomplete because of backwards "security" policies, showing a message saying "this website has told Chrome to disable autocomplete. If you wish to enable it, contact the website owners" or similar would be much more preferable to me. Maybe even leave the autocomplete behaviour in, but then put it behind a setting somewhere that's off by default. All the good use cases for autocomplete=off have been ruined by all the terrible web developers and corporate managers out there.

dang 5y ago

Chrome does not respect autocomplete=off (2018) - https://news.ycombinator.com/item?id=26309919 https://news.ycombinator.com/item?id=26309919 - March 2021 (74 comments)

pixelbath 5y ago

Why is every top-level comment equating autocomplete with the ability to paste a password? Those are two explicitly different use cases, and one should not affect the other. I don't want my password fields autocompleting; that sounds like an absolute usability nightmare. Conversely, I don't think browsers should even be able to stop me from pasting whatever I damn well please into a password field. As to the other sentiments expressed here and in the main issue thread, I don't really disagree with Google's stance on autocomplete in regular form fields. I only really care about being able to remove invalid autocomplete entries that I may have mistakenly entered in the past (without simply deleting every entry).

matheusmoreira 5y ago
> I don't want my password fields autocompleting; that sounds like an absolute usability nightmare. Why? The usability is really good. This feature is invaluable if you use unique random passwords for every web site. Security has to be painless in order to work. If it's not, people will go back to using the same weak password for every site. Letting web developers tell the browser what fields it should autofill is a fine idea. Unfortunately, they decided to use this power to turn off people's password managers for bullshit "security reasons". This is why we can't have nice things.