> autocomplete=off is no longer supported for username/password fields
As far as I can recall, autocomplete=off was originally added specifically for username and password fields, so somebody who nicked your laptop couldn't go to your bank's website and have your username and password filled in.
As a power user I find autocomplete=off pretty annoying, but I've got ways to work around it. I'm very curious what the rationale for this change is.
- This change makes it so that `autocomplete=off` does not stop the Password Manager from working. Normal form autofill can be disabled as usual.
- The password manager *always* prompts if it wants to save a password. Passwords are not saved without permission from the user.
- We are the third browser to implement this change, after IE and Chrome.
While reading some of them I wanted to shake the authors and scream: "A website can't stop a user from saving a password! All you're doing is making them save it on a Post-It instead of in their password manager!"
The only way you can recover a lastpass account is if you do it from a computer that was already authenticated with lastpass in the near past.
pretty much the only use-case i've run into and can think of.
Remember, a few years ago, not everyone had their own computer. For large chunks of the world (demographically and geographically), this is still the case.
Shared computer? You want to be applying autocomplete=off to sensitive fields. It's no guarantee, but it's one layer, assuming other layers (e.g. preventing keyloggers) are being maintained.
Only, I guess, you won't have this option, any longer.
At one point, I had to get one of my banks (big, "evil", you've heard of them) to apply it to their login web page. And I worked for another very big corporation that had at least in some people some pretty clueful in house developers. We applied it, as well. There were, and are, valid use cases. The setting alone won't save you, but it's one piece of a broader approach.
P.S. Oh yeah, and I seem to recall nudging a domain name registrar to apply it to the credit card number field on their payments page.
You should still be able to use autocomplete=off for non-password fields, like credit card.