Comment by joshstrange | Hacker News Reader

Comment by joshstrange | Hacker News Reader

I might consider adding whatever the attribute is this week (I know it's changed over the years) to prevent auto-complete. My 1Password extension keeps trying to fill in my address on the guessing field.

EDIT: Editing the page with some of the ways to disable autocomplete [0] don't seem to be working but I'm not sure if that's because 1Password binds at page load and doesn't care what I change using DevTools. In the end this is clearly 1Password's problem [0] but I sympathize with them even as I am negatively affected by it. If they had an attribute (like lastpass) we all know the worst websites/offenders on the planet (banks, intranet sites, most financial institutions, most site asking for routing/account numbers, etc) would abuse the hell out of it. It's bad enough when they try to prevent copy/pasting in. I do think they should at least provide a way to blacklist sites where you don't want to use 1Password.

[0] https://stackoverflow.com/a/51686510/1072106

[1] https://1password.community/discussion/117501/as-a-web-devel...

The search field at the bottom of Hacker News is one point of reference:

  <input type="text" name="foo" autocorrect="off" spellcheck="false" autocapitalize="off" autocomplete="false">

Tradle currently uses creative but non-standard attribute values:

  <input type="string" autocomplete="nope">

Good call! I think part of the issue in this case is the naming of the field. I’m on mobile and can’t easily check but I thought it was something like “country” or similar. I’m guessing 1Password sees that and attaches its UI, I’m seeing my saved identity/location being suggested when I click into the field. A potential fix is to rename the field and any id/class to something that is generic/not related to location. Again, this is 1Password’s fault for sure, I’m just suggesting a way to fix it.

For 1Password it’s hard to say what the fix is. I will say, 1Password needs to a decent amount of work on their identity-filling agent/component. It is wrong more often than I’d like and will clobber fields I’ve already entered with different data. It will also fill/clobber other fields that aren’t identity-related. It mistakenly thinks a field is something that it’s not, just like in this games case. It’s too greedy or too loose in its search for field to fill. Passwords/2FA/secrets/etc is rock solid, identities? Not so much.

> Tradle currently uses creative but non-standard attribute values

For autocomplete it's because Chrome unilaterally decided not to support autocomplete=off several years ago: https://bugs.chromium.org/p/chromium/issues/detail?id=914451

I had to disable autocomplete recently, neither autocomplete="false" or autocomplete="off" worked. MDN (source below) indicates using "new-password, but in my experience passing in any random string to the autocomplete attribute did work.

https://developer.mozilla.org/en-US/docs/Web/Security/Securi...

Yeah, I've taken to just generating a UUID and throwing in there as I normally have a library to do that on my frontend projects.

that only sort of sometimes works. chrome uses some sort of AI to look at the text displayed in a way that could visually be construed as a label and use that to identify the field for autocomplete.

the only foolproof method i've found is to use contenteditable spans instead of input tags, which has it whole own set of problems.

> I do think they should at least provide a way to blacklist sites where you don't want to use 1Password.

Right click the page you want to block, and check out the 1Password context menu. There's an option to disable 1Password for the current page.

I've noticed this a whole lot recently -- a whole bunch of sites inappropriately autocompleting irrelevant things.

Reply on news.ycombinator.com