The autocomplete attribute and web documents using XHTML: Difference between revisions

Line 86: Line 86:
=== Security ===
=== Security ===


1. You could try educating your users in the dangers of public and unsecured machines, and in how to use their browser's autocompletion functionality selectively. In particular, warn them of the dangers even from from acquaintances and family, who are the perpetrators in around 11% of UK identify fraud ([http://www.cifas.org.uk/reports_what_about_the_victim.asp CIFAS Research: Identify Fraud -- What About the Victim?]). Unfortunately, your users are unlikely to have the same interest in the subject that you have -- until their identity is compromised. Even if they're interested, the majority of internet users are a poor match for more technically sophisticated crooks. This, ultimately, is a serious practical flaw in the argument advanced by Lachlan Hunt and others that site authors have no "right" to restrict web client's use of autocompletion.
1. You could try educating your users in the dangers of public and unsecured machines, and in how to use their browser's autocompletion functionality selectively. In particular, warn them of the dangers even from from acquaintances and family, who are the perpetrators in around 11% of UK identify fraud ([http://www.cifas.org.uk/reports_what_about_the_victim.asp CIFAS Research: Identify Fraud -- What About the Victim?]). Unfortunately, your users are unlikely to have the same interest in the subject that you have -- until their identity is compromised. Even if they're interested, the majority of internet users are a poor match for more technically sophisticated crooks. This, ultimately, is a serious practical flaw in the argument advanced by Lachlan Hunt and others that site authors have no "right" to restrict web clients' use of autocompletion.


2. Instead of an <code>autocomplete</code> attribute, consider using a [http://en.wikipedia.org/wiki/Nonce nonce (Wikipedia)].
2. Instead of an <code>autocomplete</code> attribute, consider using a [http://en.wikipedia.org/wiki/Nonce nonce (Wikipedia)].