Hacker News Reader

Comment by ysavir | Hacker News Reader

In this case, the browser is the agent of those advertising to the user. It's not protecting your interests, it's protecting Google's interests.

If it was protecting your interests, it would be a toggleable setting that defaults to normalized behavior.

View on HN

> It's not protecting your interests, it's protecting Google's interests.

But you can always install (or develop) another browser that might do this job better for you.

> If it was protecting your interests, it would be a toggleable setting that defaults to normalized behavior.

The problem with this view is that the vast majority of end users do not want, and in fact will never know about or use a new setting, and so the when doesn't move forward. This is the opt-in problem that Google is talking about. In politics, an analogy is called public choice theory.

Users don't use thousands of sites. If a site misbehaves and users want autofill on it, they should be able to override autocomplete=off for that site.

Google could even make an extension for this to allow users to gather and share a list of sites that behave in a user unfriendly way.

But of course, it was much easier to fuck up half of the Web.

Public choice and mandates are great for things that require cooperation and agreement against race to the bottom (like tax havens), not against autocomplete fucking off.

> If a site misbehaves and users want autofill on it, they should be able to override autocomplete=off for that site.

How?

What do you imagine?

We don't need to imagine. Lots of sites abused autofill in order to prevent password management. That's why autocomplete=off gets stomped.

This website has turned off auto-complete, as they believe it may not work effectively for their forms.

* Turn on anyway * Leave disabled for this form

= Remember my choice for this website

With the same yellow bar at the top that they use for other issues. Tell them what the site is doing and ask whether they want to allow or block that, and whether to do that for all sites or only this one.

I have a site that deals with HIPPA protected information. I absolutely don’t want autofill, especially for sign in information. Chrome makes that impossible and just ignores the code.

Could you explain the downside of allowing auto-fill for sign-in information here? I understand that security is a concern, but I don't see how allowing a password manager to handle sign-ins would be harmful.

In a medical setting, most computers are public. Sharing passwords is a HIPAA violation, because HIPAA requires a complete, accurate log of everyone who has looked at or modified a medical record.

My guess is that many medical computers aren't well administrated and leave autofill on, which can easily cause accidental HIPAA violations.

Disabling autofill seems like the wrong way to handle the problem, though. Autofill does not necessarily mean that passwords are being shared; it just means that the user isn't typing them in. Strong policies on the machines in question and ensuring that users aren't sharing each others environments seems like a considerably more complete solution to me. This can be facilitated by tools like https://www.imprivata.com/single-sign-on-sso. Ironically enough, disabling autofill may actually prevent this tool from providing some of the benefits it's intended to provide.

While I agree that autofill on its own is not a complete solution to GP's scenario, it's certainly a potential point-of-failure, and I understand their need to eliminate as much risk as possible. While the most significant aspect to be improved is the security habits of the clients themselves, that doesn't mean that GP and their company should be prevented from doing what little they can just because Google wanted things to work their way.

That's why there are profiles. Even in Chrome. But too in Windows.

Or that's why then the SysAdmin should disable the password manager.

It's not up to the website.

If you have an internal site, you already control the browser, then why do you want to fight the browser from the inside instead of from the outside? :o

I can't remember exact scenarios that triggered it, but I've seen situations where Chrome autofills data other than sign-in passwords as well (also ignoring autocomplete=off).

There was a form where administrator can change certain details of another user profile, and if e-mail (or name) field was empty on a profile, then chrome would autofill it with administrator's e-mail, which can result in unwanted / corrupted data.

Some replies in this thread suggest configuring chrome differently in organizations where this is important to avoid, but when you are SaaS vendor, your users will inevitably blame you for Chrome's behavior.

Do you have concrete examples of websites that are "fucked up" because of this?

> The problem with this view is that the vast majority of end users do not want

I'm a user.

I want that. I'm probably not "a majority" but I fail to see how being assimilated to the majority without my consent, without even knowing it is happening, is "protecting my interests"

What would you think of a restaurant that charges you 50% of the bill as tip because "the majority of the customers does that"?

> What would you think of a restaurant that charges you 50% of the bill as tip because "the majority of the customers does that"?

I don't know about you but when I go to the restaurant, I can't change the price of the items. If they set the tip for you, that's pretty much setting the price, isn't it?

> If they set the tip for you, that's pretty much setting the price, isn't it?

I forgot HN is mostly an american place.

Tip in most Europe is voluntary

We don't force people to tip

IMO, breaking an established API with no reliable way to work around it is very bad. I have been bitten by this, and only now understand why. I will probably switch to Firefox.

Update: I switched to Firefox. Happy.

I don't really use that auto filling thing that much but the few time I did, Chrome asked me if I wanted to use it on that website. Isn't that what you consider a toggleable setting? I chose to use autofill my user account information on that website.

Reply on news.ycombinator.com