#28225: Credentials of the Admin login form are stored browser due autocomplete
was
enabled by default.
--------------------------------+--------------------------------------
Reporter: Pablo Catalina | Owner: nobody
Type: Uncategorized | Status: closed
Component: contrib.admin | Version: 1.11
Severity: Normal | Resolution: invalid
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------+--------------------------------------
Comment (by Tim Graham):
In fact this issue has been reported several times to the security team.
Here's the team's response:
We intentionally leave autocomplete enabled as we believe that all modern
browsers now handle local form completion in a reasonably sane manner.
Autocomplete enables individuals to use stronger passwords and makes them
less susceptible to phishing attacks. These benefits greatly outweigh the
minor risk here. If you disagree, we encourage you to also read this post:
http://blog.0xbadc0de.be/archives/124
--
Ticket URL: <https://code.djangoproject.com/ticket/28225#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/063.a5d132e6d0b914b8c2edb4fee10cdfdb%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
