Hacker News Reader

Comment by gruez | Hacker News Reader

because it's hard to determine whether something is visible. what if it's offscreen? what if it's partially off screen? what if it's 0% opacity? what if it's 0.001 opacity? what if it's 1px height/width? what if something is overlaid on top of it?

View on HN

The browser should never auto fill.

The browser should display an autofill preview as an overlay, and only add it to the DOM after the user gives confi

If users are disabling the feature, then another approach may be needed, e.g. a config setting so that only 100% visible, 0% obscured forms will be auto-filled. Allow users to whitelist the known-good scenario.

Most importantly, the page could easily wait until the login manager fills it in, and then immediately hide the form.

Can the browser prevent visibility changes to auto-filled forms?

I feel like that'd be a terrible user experience on non-malicious sites

It's not hard to determine, if you consider "visible" to mean "visible to a human." Most of the possibilities you mention are obviously not visible in that case.

The parent is demonstrating the complexity of the problem, not providing a comprehensive list of tests. It wouldn't be a problem if we knew the list.

And I'm arguing the problem isn't that complex.

The problem is 99% solved if you assume that a "visible" form must be completely within the current view, at 100% opacity and unobscured by other elements. Apply the same heuristics used by bots to avoid honeypots and fake forms.

It is not 99% solved by that assumption because if those are the properties used to detect visibility then they will not be the methods used to avoid detection.

Reply on news.ycombinator.com