Don't use autofill in your browser(yoast.com)

129 pointsby DavidWanjiruvor 13 Jahren68 comments

http://yoast.com/autocomplete-security/

73 comments

viraptorvor 13 Jahren

That's a misuse for the term "autocomplete" in my opinion. What he complains about is "autofill", not "autocomplete" as I understand it. Autocomplete takes the values you used previously and gives you suggestions for the stuff you're typing in yourself. Autofill tries to guess what values are required and fills them in without additional interactions.

They're very different mechanisms...

yaphvor 13 Jahren

Fully agree, using "autocomplete" is misleading. The suggestions that go into auto-complete fields come from the server, autofill from the client.

aaronemvor 13 Jahren

You conflate autocompletion provided by the browser, based on values previously submitted in identically named fields, and autocompletion against values provided by the server.

AndrewDuckervor 13 Jahren

Doesn't seem to be an issue in Firefox, as far as I can tell. Certainly didn't fill any other fields for me.

Tobuvor 13 Jahren

Even if it showed you the fields, it wouldn't be conclusive proof of a privacy leak. Firefox shows links visited without exposing that property outside of render context: https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...

elivor 13 Jahren

The fields in this demo are being echoed back from the server, so if you see values in them then it is indeed proof they are being leaked.

Tobuvor 13 Jahren

The fields appear immediately, the demo actually does this:

    $("#mine").submit( function() {
    $("#hide").css("height","auto");

[deleted]vor 13 Jahren

elwellvor 13 Jahren

I think the concern is that you might submit a form to a server without knowing that you're sending all that data (just some of it).

dijitvor 13 Jahren

I have the same results.

Doesn't matter what I picked in autocomplete, nothing else was submitted.

(firefox 24 on linux)

computervor 13 Jahren

It's an issue for me with the Lastpass addon in Firefox, if I use the Lastpass autofill. That doesn't make it a Firefox issue, of course.

bclvor 13 Jahren

And then only if you opt-in for the site.

elwellvor 13 Jahren

Works in Chrome if I use certain autofill sets (ended up testing with email address rather than name and it worked)

justincormackvor 13 Jahren

Chrome would not autofill my name, just my email and then it filled in everything else. Disabled it.

[deleted]vor 13 Jahren

mortenjorckvor 13 Jahren

I remeber noting with concern several years ago that Safari was blindly saving my credit card number along with all my other auto-fill data. Thing is, I recall observing that behavior stopping around Safari 4 or so – the browser appeared to be using something along the lines of the data detectors that put calendar links on times mentioned in emails, and saving everything but the credit card field.

crashandburn4vor 13 Jahren

This is weird, I'm on chrome but it doesn't happen for me...

DanBCvor 13 Jahren

I'm using Chrome version 30.0.1599.101 m on Vista. The form did what the post said it would - all those extra fields got filled in.

next89vor 13 Jahren

Same on W7, Chrome build 30.0.1599.101 m.

bad_uservor 13 Jahren

It did happen to me on Chrome, but Chrome also gives you hints that it will do auto-filling should you select the value from that list.

hydrologyvor 13 Jahren

Same here.

twistervor 13 Jahren

Sephiroth87vor 13 Jahren

Safari tells you what is actually going to autocomplete, so you could easily catch stuff that should not be sent...

kalleboovor 13 Jahren

This is true, and actually a pretty smart feature, but you have to take the time to double-check (which I suspect most users won't).

cowsandmilkvor 13 Jahren

Usually I agree that people will blindly click through, but I don't see people clicking through this[1]. Especially if Safari said it would auto-fill your credit card number and you weren't buying anything?

[1] https://www.evernote.com/shard/s356/sh/dcf7867e-eb16-4e0e-83...

kalleboovor 13 Jahren

For me if I just enter my first name, then I get the small AutoFill popup with my contact card preselected, and just hit enter, it autofills without me seeing the full popup with the detailed info in it.

jasonlotitovor 13 Jahren

My understanding is that even credit card information is only available if the person is specifically in a credit card field, and not just the name.

rocvor 13 Jahren

Isn't that like claiming individual permissions pop-ups are working just fine on mobile devices, because people are carefully and individually considering whether each given app needs each requested permission?

If some autofill feature starts training users to click "Ok, Ok, Ok, Ok, whatever, just Ok!" any time they sign up for some account or site feature, how long until masses are unwittingly sending along way more data than any sober assessment suggests they ought to and we're shrugging our shoulders and saying "well, the site asked..."

praseodymvor 13 Jahren

Firefox and the Mozilla Suite have had a very similar problem since at least 2005: it autofilled usernames and passwords, which creates a problem with XSS or user-generated content on the same domain. The bug was marked WONTFIX: https://bugzilla.mozilla.org/show_bug.cgi?id=280469

bad_uservor 13 Jahren

Strange, but for me Firefox does not auto-fill passwords, unless you provide a username (and of course, you opted into auto-filling). What did it do, as I don't understand? Did it automatically auto-fill password fields that happened to get loaded on the page?

praseodymvor 13 Jahren

It indeed autofilled password fields on the page. Haven't re-tested it, but I think most browsers still show the same behaviour.

Ellipsis753vor 13 Jahren

Seems to work correctly (only name is submitted as one would expect) on Firefox 24.0 and Chromium 30.0. Edit: This is on Gentoo Linux.

elwellvor 13 Jahren

You have to have an autofill set up with more information than just your name. You can tell if you have this set up because when the autofill choices show they will have your address etc in gray next to the choices you are auto-completing.

michaelmartinvor 13 Jahren

I just don't store credit card details in my browser. Auto-complete for emails is extremely handy and I use that all the time, but does purchasing things online really need to be any easier?

I don't mind reaching for my wallet there; it forces you to make a conscious decision to spend the money, which is at least slightly better than a 1-click impulse.

elwellvor 13 Jahren

Credit card details are not the main concern here (because they are separated on Chrome), but you could send your address and phone number to a server without expecting to send more than your name or email address.

bad_uservor 13 Jahren

True and it takes what? 1 minute of typing? Do we really need to go faster than that? Of course, companies are all in favour, but it's not in our interest.

wil421vor 13 Jahren

I dont see the problem all that was filled in was my name. The other fields were left blank. Even when I reentered it after the other fields popped up.

elwellvor 13 Jahren

ck2vor 13 Jahren

Should be easy to make a proof of concept page to scare people dumb enough to have credit card auto-complete.

Just make hidden form fields for every field name you can think of, then make some onload javascript to welcome them to the page with any fields that aren't empty.

gizmovor 13 Jahren

Oh, c'mon! Storing credit card data in Autofill is actually recommended by Google and considered secure: https://support.google.com/chrome/answer/142893?hl=en

You shouldn't call people dumb for following Google's instructions. I agree with you that storing CC details in a web browser is a bad idea, but we should take issue with Chrome here (and other browsers) not with regular "dumb" users.

kalleboovor 13 Jahren

Apple are also touting credit card autofill with their new version of OS X, with strong claims of security. http://www.apple.com/osx/whats-new/#gallery-icloud-keychain-...

ams6110vor 13 Jahren

I always disable all "auto" functions in any browser. Autocompete for forms and URLs, remember passwords, everything I can find a switch for I turn off. Makes the browser faster and I feel like I'm more in control of it.

ubercow13vor 13 Jahren

If only you could turn off auto-rendering, that bugs the hell out of me

kevinmchughvor 13 Jahren

Have you quantified that the browser speed gain offsets the time spent doing work the browser could do for you?

freewheelingvor 13 Jahren

Web devs can recommend input fields not use autocomplete: http://www.w3schools.com/tags/att_input_autocomplete.asp

It's considered good practice to use it on login fields, but otherwise depends on whether you think security or user preference should take priority.

kalleboovor 13 Jahren

Why is it good practice to use it on login fields? That just means your users will use weaker (easier to remember) passwords on your site instead of using random, unique ones stored in a password manager.

imurrayvor 13 Jahren

Users that find this "good practice" annoying can override it with a bookmarklet or extension: http://kb.mozillazine.org/User_name_and_password_not_remembe...

aaronemvor 13 Jahren

I've noticed with Firefox (17 ESR) that, having once used Firebug to delete the 'autocomplete="no"' attribute on a password field and then submitted the form, it's not necessary to do so again; in whatever heuristic Firefox uses to determine how to behave in that case, the existence of auto-completion data for the field apparently overrides the advice given by the attribute. For those leery of adding still more extensions to a Firefox profile already well larded with them, this may be useful information.

DanBCvor 13 Jahren

An attacker that can make use of an auto-completing password field has got enough access to mean that the game is over anyway - they can get that password from a variety of other sources on the machine.

Turning off autocomplete on login fields doesn't make that form more secure, and it does annoy users.

As kalleboo says, it probably reduces security as your users change to easy to type passwords, or keep needing password resets.

freewheelingvor 13 Jahren

Sorry, there's a bit of misunderstanding here; I should have made it clearer. Password type fields shouldn't autocomplete on browsers anyway. The "good practice" I meant is for devs to set autocomplete off for the username field - to prevent the login username or email address popping up (especially if the site is accessed on public or shared computers).

DanBCvor 13 Jahren

That's just infuriating. You're choosing to break functionality that I rely on to help me log in to your website, and there's absolutely no reason to do so.

> especially if the site is accessed on public or shared computers

People setting up those computers need to learn how to provide clean sessions for their users, rather than relying on every single website in the world doing weird things in forms.

gr3yh47vor 13 Jahren

I'm sorry, I've never used autocomplete for a few privacy related reasons, and this was one of them... this seems obvious, to the point where I thought the title was written in a sarcastic 'duh' tone...

I figured not letting your (google especially) browser store personal details was pretty much common privacy/security sense at this point.

webhatvor 13 Jahren

Only occurred in Safari for me, not in Chrome or FireFox.

Also I was a little confused by autocomplete, I thought he meant for the address bar.

elwellvor 13 Jahren

Worked in Chrome for me.

thatmanjosevor 13 Jahren

Tested this with Autocomplete off in both Safari and Chrome, but completed the forms with Lastpass. Same problem.

rejoindervor 13 Jahren

Can someone explain the following page please? (As in what's being demonstrated here.)

https://yoast.com/research/autocompletetype.php

ondiekijuniorvor 13 Jahren

well I don't get the justification for the headline

DavidWanjiruvor 13 Jahren

I added the word "apparently", coz I don't know if what the article claims is true or not...

Aqueousvor 13 Jahren

This seems like an easy fix for the layout engines. Only include a field on autofill if it's currently visible on screen.

One might even classify this as a bug.

daveasdfvor 13 Jahren

"Visible on screen" unfortunately is a hard thing to determine. You can easily imagine a textbox with white text on a white background, or a very small textbox, or a textbox that briefly pops up whenever you type a keystroke or click the mouse, or...

Browsers really need to support some mechanism where the user can determine precisely what information will be filled prior to it being handed over to the website. This needn't be difficult; Chrome's existing autofill popup already displays a subset of the information, the popup just needs to give a fuller picture.

mintplantvor 13 Jahren

    ----------------------------------------------------
    | This webpage is asking for information that your |
    | browser can automatically fill in for you. Check |
    | the box next to each item you'd like to include. |
    |                                                  |
    | [x] Email address - [email protected]              |
    | [ ] Name - Bob Jones                             |
    | [ ] Address - 123 Sample Street                  |
    |                                                  |
    | [Autofill] [No thanks]                           |
    ----------------------------------------------------

snewmanvor 13 Jahren

I suspect this would be very difficult to implement robustly. There are just too many ways to hide something: color it white, overlay another element on top, use a weird font that causes it to look like something else, ...

RoboKittenvor 13 Jahren

This would not be hard to do. There are standard names for the auto complete form inputs. The browser (or plugin) could be configured to notify you if some/any of those fields are about to be posted and warn the user using a native code generated pop-up (not a web pop-up).

tambourine_manvor 13 Jahren

Just name and email here, but I guess I'm paranoid enough.

peter303vor 13 Jahren

When your girlfriend borrows your computer and the browser sends her to porn sites.

kolevvor 13 Jahren

You don't use "private browsing"? BTW, Chrome supports multiple profiles now.

rejoindervor 13 Jahren

I guess that's for signed in users?

Groxxvor 13 Jahren

No, it's for everything, though it might sound that way. Add a user on the settings page, it'll open up the switching UI, no sign-in required. (unless they changed that recently, of course. but that would suck.)

rejoindervor 13 Jahren

Nice hidden feature! Cheers.

anonemouscowardvor 13 Jahren

AsymetricComvor 13 Jahren

Seems to be an issue with Chrome only, which is unsurprising.

markdownvor 13 Jahren

1password works great, and is secure.

kalleboovor 13 Jahren

I just tried 1password Safari integration with the test form[0] and it had the same problem as Safari's own autofill (it filled out the hidden fields).

[0]https://yoast.com/research/autocompletetype.php