<story><title>Safari tries to fill username</title><url>https://github.com/livewire-ui/spotlight/issues/25</url></story><parent_chain><item><author>WayToDoor</author><text>Related, there is a &amp;quot;bug&amp;quot; in chrome that disabled autocomplete=&amp;quot;off&amp;quot; on input elements, marked as won&amp;#x27;t fix&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;bugs.chromium.org&amp;#x2F;p&amp;#x2F;chromium&amp;#x2F;issues&amp;#x2F;detail?id=587466&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bugs.chromium.org&amp;#x2F;p&amp;#x2F;chromium&amp;#x2F;issues&amp;#x2F;detail?id=587466&lt;/a&gt;</text></item></parent_chain><comment><author>airza</author><text>The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality.
But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can&amp;#x27;t do that, a pretty large percentage of them just give up and write the password down somewhere.&lt;p&gt;In the end, i find a lot of chrome&amp;#x27;s decision to implement spec-breaking behavior awful in the context of having a website that works forever (Looking at you, samesite). But this behavior rarely breaks functionality and on the whole makes the web a &lt;i&gt;lot&lt;/i&gt; more secure.</text></comment>
<story><title>Safari tries to fill username</title><url>https://github.com/livewire-ui/spotlight/issues/25</url></story><parent_chain><item><author>WayToDoor</author><text>Related, there is a &amp;quot;bug&amp;quot; in chrome that disabled autocomplete=&amp;quot;off&amp;quot; on input elements, marked as won&amp;#x27;t fix&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;bugs.chromium.org&amp;#x2F;p&amp;#x2F;chromium&amp;#x2F;issues&amp;#x2F;detail?id=587466&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bugs.chromium.org&amp;#x2F;p&amp;#x2F;chromium&amp;#x2F;issues&amp;#x2F;detail?id=587466&lt;/a&gt;</text></item></parent_chain><comment><author>heinrichhartman</author><text>I tend to side with Chrome here.&lt;p&gt;IMHO, the decision of whether to show auto-complete should be with the user and not with the website. When I install an auto-complete add-on or activate a browser feature, I expect the AC to be available on ALL input fields, whether the site owner thought that would be a good idea or not.&lt;p&gt;Now, there is a valid question on how the user should be able to configure the AC behavior, and how the website may help inform this configuration, but the decision should be with the user. The website should not have the final say.&lt;p&gt;So I would see this as more of a shortcoming of the HTML Spec.</text></comment>