Disabling Safari autofill on usernames and passwords

by

The reason browsers are ignoring autocomplete=off is because there have been some web-sites that tried to disable auto-completing of passwords.

That is wrong.

And in July 2014 Firefox was the last major browser to finally implement the change to ignore any web-site that tries to turn off autocompleting of passwords.

One of the top user-complaints about our HTML Forms AutoComplete feature is “It doesn’t work– I don’t see any of my previously entered text.” When debugging such cases, we usually find that the site has explicitly disabled the feature using the provided attribute, but of course, users have no idea that the site has done so and simply assume that IE is buggy. In my experience, when features are hidden or replaced, users will usually blame the browser, not the website.

Any attempt by any web-site to circumvent the browser’s preference is wrong, that is why browsers ignore it. There is no reason known why a web-site should try to disable saving of passwords.

  • Chrome ignores it
  • Safari ignores it
  • IE ignores it
  • Firefox ignores it

At this point, web developers typically protest “But I wouldn’t do this everywhere– only in a few little bits where it makes sense!” Even if that’s true, unfortunately, this is yet another case where there’s really no way for the browser to tell the difference. Remember, popup windows were once a happy, useful part of the web browsing experience, until their abuse by advertisers made them the bane of users everywhere. Inevitably, all browsers began blocking popups, breaking even the “good” sites that used popups with good taste and discretion.

What if I’m a special snowflake?

There are people who bring up a good use-case:

I have a shared, public area, kiosk style computer. We don’t want someone to (accidentally or intentionally) save their password so the next user could use it.

That does not violate the statement:

Any attempt by any web-site to circumvent the browser’s preference is wrong

That is because in the case of a shared kiosk:

  • it is not the web-server that has the oddball policy
  • it is the client user-agent that has the oddball policy

The browser (the shared computer) is the one that has the requirement that it not try to save passwords.

The correct way to prevent the browser from saving passwords
is to configure the browser to not save passwords.

Since you have locked down and control this kiosk computer: you control the settings. That includes the option of saving passwords.

In Chrome and Internet Explorer, you configure those options using Group Policies (e.g. registry keys).

From the Chrome Policy List:

AutoFillEnabled

Enable AutoFill

Data type: Boolean (REG_DWORD)

Windows registry location: Software\Policies\Chromium\AutoFillEnabled

Description: Enables Chromium’s AutoFill feature and allows users to auto complete web forms using previously stored information such as address or credit card information. If you disable this setting, AutoFill will be inaccessible to users. If you enable this setting or do not set a value, AutoFill will remain under the control of the user. This will allow them to configure AutoFill profiles and to switch AutoFill on or off at their own discretion.

Please pass the word up to corporate managers that trying to disable autocompleting of password is wrong. It is so wrong that browsers are intentionally ignoring anyone who tries to do it. Those people should stop doing the wrong thing.™

Put it another way

In other words:

  • if the users browser
  • mistakes “Please enter the name of your favorite maiden name’s first color.” for a new password
  • and the user
  • doesn’t want their browser
  • to update their password,
  • then they
  • will click Nope

enter image description here

  • if i want to save my HIPPA password: that’s my right
  • if i want to save my PCI password: that’s my right
  • if i want to save the “new password for the user”: that’s my right
  • if i want to save the one-time-password: that’s my right
  • if i want to save my “first color’s favorite maiden” answer: that’s my right.

It’s not your job to over-rule the user’s wishes. It’s their browser; not yours.

More Related Contents:

  1. Disabling Chrome Autofill
  2. Disable form autofill in Chrome without disabling autocomplete [duplicate]
  3. How do you disable browser autocomplete on web form field / input tags?
  4. How to allow http content within an iframe on a https site [duplicate]
  5. How to trigger Autofill in Google Chrome?
  6. Google Chrome form autofill and its yellow background
  7. Override browser form-filling and input highlighting with HTML/CSS
  8. Cross Domain Form POSTing
  9. background: fixed no repeat not working on mobile
  10. Can local storage ever be considered secure? [closed]
  11. autocomplete =’off’ is not working when the input type is password and make the input field above it to enable autocomplete
  12. Autocomplete off vs false?
  13. Required Attribute Not work in Safari Browser
  14. How to prevent a browser from storing passwords
  15. Why are iframes considered dangerous and a security risk?
  16. IFRAMEs and the Safari on the iPad, how can the user scroll the content?
  17. Using HTML in jQuery UI autocomplete
  18. Use HTML5 (datalist) autocomplete with ‘contains’ approach, not just ‘starts with’
  19. Safari 9.0 can not play mp4 video on the storage server
  20. plays in other browsers, but not Safari
  21. What happens when localStorage is full?
  22. Safari anchors on links not working
  23. Safari – Videos load far too slowly
  24. Chrome, Safari ignoring max-width in table
  25. Browser Canvas CORS Support for Cross Domain Loaded Image Manipulation
  26. Is any way that is safe to display videos in a browser
  27. What does the shrink-to-fit viewport meta attribute do?
  28. Multiple select in Safari iOS 7
  29. How to style the browser’s autocomplete dropdown box?
  30. Prevent ligatures in Safari (Mavericks/iOS7) via CSS

Leave a Comment