Comments on: Tricking browsers that are storing passwords

By: Kevin Zak

Kevin Zak — Mon, 17 Mar 2008 00:15:38 +0000

It’s an interesting question you pose, Jory. While some may find it an annoying quirk, I think that an extra layer of security like what you proposed is worth it. I used to worry about family members messing with things that I stay logged into. Now I generally lock my sessions if I’m going to be gone for any extended period of time. All in all, I don’t think it’s unreasonable to limit unessential functionality for security’s sake.

By: Jory

Jory — Wed, 20 Feb 2008 11:15:12 +0000

Wow, Seth, I had no idea there was such a thing.

Seems like I’ll need to use a custom doctype for this though and I’m not sure I’m 100% comfortable doing that just yet. (Knowing me, I’ll break more this I fix when doing something like that.)

By: Ben Babcock

Ben Babcock — Wed, 20 Feb 2008 03:47:27 +0000

I don’t think it’s a big deal if you do that.

While in general I prefer to let a user keep control of his or her browsing experience, there’s always the exception to the rule. In a case like this, it’s reasonable to prevent users from automatically filling out password forms–that’s extra security, after all. And it’s not like you’re adding 300 layers of security complete with a CAPTCHA image, and ID image, a question, an ID phrase, and whatnot.

*cough* My bank sucks *cough*

By: Seth

Seth — Wed, 20 Feb 2008 02:55:04 +0000

Done.