6 ms·

Web devs can recommend input fields not use autocomplete: http://www.w3schools.com/tags/att_input_autocomplete.asp http://www.w3schools.com/tags/att_input_autoc

Web devs can recommend input fields not use autocomplete: http://www.w3schools.com/tags/att_input_autocomplete.asp http://www.w3schools.com/tags/att_input_autocomplete.asp It's considered good practice to use it on login fields, but otherwise depends on whether you think security or user preference should take priority.

kalleboo 13y ago
Why is it good practice to use it on login fields? That just means your users will use weaker (easier to remember) passwords on your site instead of using random, unique ones stored in a password manager.
DanBC 13y ago
An attacker that can make use of an auto-completing password field has got enough access to mean that the game is over anyway - they can get that password from a variety of other sources on the machine. Turning off autocomplete on login fields doesn't make that form more secure, and it does annoy users. As kalleboo says, it probably reduces security as your users change to easy to type passwords, or keep needing password resets.
- freewheeling 13y ago
  Sorry, there's a bit of misunderstanding here; I should have made it clearer. Password type fields shouldn't autocomplete on browsers anyway. The "good practice" I meant is for devs to set autocomplete off for the username field - to prevent the login username or email address popping up (especially if the site is accessed on public or shared computers).
  - DanBC 13y ago
    That's just infuriating. You're choosing to break functionality that I rely on to help me log in to your website, and there's absolutely no reason to do so. > especially if the site is accessed on public or shared computers People setting up those computers need to learn how to provide clean sessions for their users, rather than relying on every single website in the world doing weird things in forms.
imurray 13y ago
Users that find this "good practice" annoying can override it with a bookmarklet or extension: http://kb.mozillazine.org/User_name_and_password_not_remembered#Sites_prohibit_password_saving http://kb.mozillazine.org/User_name_and_password_not_remembe...
- aaronem 13y ago
  I've noticed with Firefox (17 ESR) that, having once used Firebug to delete the 'autocomplete="no"' attribute on a password field and then submitted the form, it's not necessary to do so again; in whatever heuristic Firefox uses to determine how to behave in that case, the existence of auto-completion data for the field apparently overrides the advice given by the attribute. For those leery of adding still more extensions to a Firefox profile already well larded with them, this may be useful information.

kalleboo 13y ago

Why is it good practice to use it on login fields? That just means your users will use weaker (easier to remember) passwords on your site instead of using random, unique ones stored in a password manager.

DanBC 13y ago

An attacker that can make use of an auto-completing password field has got enough access to mean that the game is over anyway - they can get that password from a variety of other sources on the machine. Turning off autocomplete on login fields doesn't make that form more secure, and it does annoy users. As kalleboo says, it probably reduces security as your users change to easy to type passwords, or keep needing password resets.

freewheeling 13y ago
Sorry, there's a bit of misunderstanding here; I should have made it clearer. Password type fields shouldn't autocomplete on browsers anyway. The "good practice" I meant is for devs to set autocomplete off for the username field - to prevent the login username or email address popping up (especially if the site is accessed on public or shared computers).
- DanBC 13y ago
  That's just infuriating. You're choosing to break functionality that I rely on to help me log in to your website, and there's absolutely no reason to do so. > especially if the site is accessed on public or shared computers People setting up those computers need to learn how to provide clean sessions for their users, rather than relying on every single website in the world doing weird things in forms.

imurray 13y ago

Users that find this "good practice" annoying can override it with a bookmarklet or extension: http://kb.mozillazine.org/User_name_and_password_not_remembered#Sites_prohibit_password_saving http://kb.mozillazine.org/User_name_and_password_not_remembe...

aaronem 13y ago
I've noticed with Firefox (17 ESR) that, having once used Firebug to delete the 'autocomplete="no"' attribute on a password field and then submitted the form, it's not necessary to do so again; in whatever heuristic Firefox uses to determine how to behave in that case, the existence of auto-completion data for the field apparently overrides the advice given by the attribute. For those leery of adding still more extensions to a Firefox profile already well larded with them, this may be useful information.