Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

autocomplete=off does not prevent you from using keepass, it prevents your browser from storing your password in your HD in plaintext.

It's arguable that it's not the website's decision where the user caches it's passwords, but in high security environments I don't think it is an overkill.



I doubt the autocomplete browser feature applies to password entry. It would freak people out if their browser started suggesting the password as you typed. It does apply for the username/email field, though.


For a password field, "autocomplete" doesn't mean to suggest candidate completions, but rather to prefill with the password part of a previously saved username-password pair, and to offer to save such a pair (or update an existing one with a newly entered and different password) when the form is submitted. Giving the field an "autocomplete" attribute with the value "off" disables this behavior, which matters for PCI compliance because it forestalls browsers from storing the password when they might do so insecurely.


That makes sense to me in a way I didn't think of before.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: