RE: Passsword managers and autocomplete='off'

2014-01-03 Thread Adrian Bateman
On Thursday, December 12, 2013 1:57 PM, Jonas Sicking wrote: On Thu, Dec 12, 2013 at 1:45 PM, Joel Weinberger j...@chromium.org wrote: But it would suck if the result is that they create their own form fields using divs and/or contenteditable. That's true, although some things like that

Re: Passsword managers and autocomplete='off'

2013-12-19 Thread Mark Callow
On 2013/12/18 7:12, Maciej Stachowiak wrote: I also forgot to mention: (3) At least some sites believe that consumer finance regulations require them to use autocomplete=off. They believe their requirement to protect the user's authentication information and prevent it from being accessed by

RE: Passsword managers and autocomplete='off'

2013-12-18 Thread Jonathan Bond-Caron
On the other hand, if all browsers collectively chose to completely ignore autocomplete=off, that might allow proceeding more aggressively. Sure, and that's why we're bringing it up with the standards body. Before we proceed any further, we want to make sure that (a) our intention is

Re: Passsword managers and autocomplete='off'

2013-12-17 Thread Joel Weinberger
Thanks for the feedback, everyone. A few people at this point have suggested emailing the wha...@whatwg.org list since this is really an HTML feature; I'll do that in a few. In response to Ian's question, I'm referring to the W3 WebForms standard:

Re: Passsword managers and autocomplete='off'

2013-12-17 Thread Ian Hickson
On Tue, 17 Dec 2013, Joel Weinberger wrote: Thanks for the feedback, everyone. A few people at this point have suggested emailing the wha...@whatwg.org list since this is really an HTML feature; I'll do that in a few. In response to Ian's question, I'm referring to the W3 WebForms

Re: Passsword managers and autocomplete='off'

2013-12-17 Thread Maciej Stachowiak
On Dec 17, 2013, at 11:21 AM, Joel Weinberger j...@chromium.org wrote: Thanks for the feedback, everyone. A few people at this point have suggested emailing the wha...@whatwg.org list since this is really an HTML feature; I'll do that in a few. In response to Ian's question, I'm referring

Re: Passsword managers and autocomplete='off'

2013-12-17 Thread Joel Weinberger
On Tue, Dec 17, 2013 at 2:12 PM, Maciej Stachowiak m...@apple.com wrote: On Dec 17, 2013, at 11:21 AM, Joel Weinberger j...@chromium.org wrote: Thanks for the feedback, everyone. A few people at this point have suggested emailing the wha...@whatwg.org list since this is really an HTML

Re: Passsword managers and autocomplete='off'

2013-12-13 Thread Maciej Stachowiak
On Dec 12, 2013, at 11:20 AM, Joel Weinberger j...@chromium.org wrote: Hi all. For a while now, we have wanted on Chrome to ignore autocomplete='off' for password fields for the password manager. We believe that the current respect for autocomplete='off' for passwords is, in fact, harming

Re: Passsword managers and autocomplete='off'

2013-12-13 Thread Ian Hickson
On Thu, 12 Dec 2013, Joel Weinberger wrote: This is a feature (or anti-feature, depending on your perspective :-) that has been touted as good security for quite some time (in fact, the W3C spec specifically calls it out in that regard). Which spec are we talking about here? -- Ian

Re: Passsword managers and autocomplete='off'

2013-12-12 Thread Jonas Sicking
On Dec 12, 2013 11:21 AM, Joel Weinberger j...@chromium.org wrote: What are this group's thoughts on this? Any particular concerns with this approach? I like the approach. The issue in the past has been that banks were extremely worried about the formfill feature in browsers. To the extent

Re: Passsword managers and autocomplete='off'

2013-12-12 Thread Joel Weinberger
On Thu, Dec 12, 2013 at 1:21 PM, Jonas Sicking jo...@sicking.cc wrote: On Dec 12, 2013 11:21 AM, Joel Weinberger j...@chromium.org wrote: What are this group's thoughts on this? Any particular concerns with this approach? I like the approach. Awesome, and thanks for this feedback :-)

Re: Passsword managers and autocomplete='off'

2013-12-12 Thread Jonas Sicking
On Thu, Dec 12, 2013 at 1:45 PM, Joel Weinberger j...@chromium.org wrote: But it would suck if the result is that they create their own form fields using divs and/or contenteditable. That's true, although some things like that are already pretty prevalent so we've come up with decent

Re: Passsword managers and autocomplete='off'

2013-12-12 Thread Joel Weinberger
On Thu, Dec 12, 2013 at 1:57 PM, Jonas Sicking jo...@sicking.cc wrote: On Thu, Dec 12, 2013 at 1:45 PM, Joel Weinberger j...@chromium.org wrote: But it would suck if the result is that they create their own form fields using divs and/or contenteditable. That's true, although some things

Re: Passsword managers and autocomplete='off'

2013-12-12 Thread Jonas Sicking
On Thu, Dec 12, 2013 at 2:03 PM, Joel Weinberger j...@chromium.org wrote: On Thu, Dec 12, 2013 at 1:57 PM, Jonas Sicking jo...@sicking.cc wrote: On Thu, Dec 12, 2013 at 1:45 PM, Joel Weinberger j...@chromium.org wrote: But it would suck if the result is that they create their own form fields