Should autocomplete="off" be used for all sensitive fields?

Question

What are your thoughts about this issue in regards to an e-commerce environment?

Do you think it is wise to turn autocomplete off on all sensitive input fields such as passwords (for log-in areas), or will this just inconvenience the client?

Answer 1

Unless it is a highly-secure site, I would tend to leave autocomplete on. If it is for a password field, the browser will prompt the user if they want to save the information, at which point the user can make their own decision.

Answer 2

I hate websites that do that. It is the client's decision if they want to save passwords or not. What is particularly irksome is that this attribute breaks OS X's native KeyChain support. So, even though the user has stored his password in a secure file, and authorized themselves and the application to use it, the website still thinks it knows better. Just plain annoying.

Answer 3

It depends what you mean by e-commerce. In Internet banking you should disable autocomplete. In online shopping - not necessarily.

It's worth remembering that autocomplete does not force remembering passwords. User has to agree to store their credentials, so they always can reject.

Answer 4

I really dislike that when I start to type in my credit card number and it lists all of the numbers I have used in the past, as well as the 3 digit code. Not cool IMO.

Answer 5

I concur. By habit, I leave autocomplete on. However, there was a project for the air force I was working on that had a requirement to disble autocomplete. Really depends on your requirements.

Answer 6

I actually don't think i've ever seen "autocomplete" work on a password field.

Autocomplete(when you start typing something in a form field, and the browser popups up a list of suggestions), and asking the browser to remember your user name and password are two different things.

If you're talking about the browser feature that remembers your username and password, i'm not aware of a way for you to disable that on the user's machine.

Answer 7

I use password/form managers like 1Password and RoboForm specifically to get around websites that disable autocomplete; these add-ons typically ignore the website's preferences in favor of their own more sophisticated logic.

Answer 8

An eCommerce application I worked on several years ago underwent a security audit and one of their recommendations was to disable autocomplete for sensitive fields.

It wasn't a strict requirement, but it probably will be at some point, given how eCommerce standards are these days..

Answer 9

standard industry best practice is to turn autocomplete off for password fields, but leave it on for username fields.

Answer 10

Most e-commerce sites disable autocomplete for credit card fields. They store and redisplay the info when an authenticated user returns, then only require the user to re-enter the CVV. This way the site gets users to sign up (otherwise, they'd have to re-enter the full CC info every time), keeps the CC info masked on subsequent visits, and only burdens the user with entering a three-digit number. (It's also a small way of building secure practice around CC numbers so users will hopefully be more protective of them.)

Keep in mind that setting autocomplete on/off only addresses confidentiality of data for shared environments, i.e. more than one person accesses the same browser. For example, if your app were intended for a classroom, then it would make more sense to disable autocomplete entirely since the app will be re-used in the same browser by many different people.

Consider it an (in)convenience feature, not a security feature. You can't protect users from every dumb mistake when sharing browsers (like not logging out) and, to be nicer to dumb users, it won't have any bearing on client-side attacks like keyloggers. If the shared environment isn't secure, then your app can't do much to protect its users.

Answer 11

Autocomplete should be turned off.

I understand you may not like it. Now, consider that an attacker gains access to your account due to this shortcut. Yes, your account is compromised, but the company's web application is also compromised. This opens the door for other, deeper, attacks, such as stored XSS, etc.

So sure, its an inconvenience for you, but its a protective measure for the company.