Hacker News Reader

I'm just a few paragraphs in and already this definitive guide is getting you flunked in audits. It's not a question whether you should disable autocompletes on password fields; it's an audit point.

(It is, as an aside, also a terrible idea to ask users to store their passwords in browser autocomplete dictionaries.)

View on HN

I'm confused. Aren't password fields treated differently than say, my zip code, when stored by browsers? Firefox and Chrome have pretty sophisticated credential storage facilities with syncing and master password protection.

Can you really even call browser password storage "autocomplete"? Doesn't the browser see a password field and use the credential storage mechanism?

I suppose in OSX passwords can be stored to the keychain which is encrypted, but really, how many people just allow their browser access to their keychain without ever prompting them after the first time ?

It's possible to simply "show password" for any of the stored sites using your browser's settings menu. At least for Chrome on Windows this is the case.

Reply on news.ycombinator.com