autocomplete="off" for 1Pass suggested fields

ukhan

Perhaps it makes sense to add the autocomplete="off" attribute to the 1Pass suggested fields?

---

1Password Version: Not Provided
Extension Version: 1Password X 1.9.0
OS Version: Not Provided
Sync Type: Not Provided

jxpx777

Hi, @ukhan. Thanks for the suggestion. 1Password has historically not respected autocomplete="off" because it's misused by some sites to attempt to prevent users from using password managers.¹ For instance, Wells Fargo's sign-in form still includes it. (I just checked to be sure!) Perhaps we could use this as part of the mix for determining the classification of what 1Password is seeing on the page, but I don't think we will ever allow 1Password's behavior to be dictated by one misused attribute value. Most browsers these days also do not respect the autocomplete attribute for sign-in forms. It just took them a few extra years to catch up with 1Password's lead. :blush:

For now, we are focused on improving 1Password's recognition of forms' and fields' purposes. Could you share the URL for this page so that we can include it in our machine learning model's training data?

--
Jamie Phelps
Code Wrangler @ 1Password
Fort Worth, Texas

---

1. I say misuse because there could be legitimate times when both the site and the user would want to avoid autocomplete on a field. For instance, if the value for the field could not ever be restored because it's a rotating value such as a TOTP field. 1Password X would still ignore this since it knows how to fill TOTP fields, but it would be reasonable for the site to ask the browser not to remember the particular value that was entered since restoring that value the next time the user visits the page would be incorrect behavior that results in a worse user experience. There's a good article about security and the autocomplete attribute on Mozilla's site if you're interested in learning more: https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion ;↩︎

ukhan

@jxpx777, Thanks for the reply.
I meant the option "Turn off autocomplete for suggested fields" in the 1Password X extension settings (switched Off by default).

Sample form from my screenshot. The form is correctly recognized by the extension, except for the ugliness with autocomplete.

jxpx777

I'm sorry, @ukhan, but I'm not following. (Maybe I haven't had enough coffee this morning!) Are you saying that you want 1Password to add autocomplete="off" to the fields when it will show its inline menu so that you don't have both the 1Password inline menu and the browser's autocomplete showing together? I'm not sure this is something we want to do… Generally we recommend that you disable your browser's form filling capabilities in favor of 1Password's. Do you need both? I'd like to understand the use cases if so.

ukhan

@jxpx777, yes I'm about it. Sorry for my bad explanation.
Disabling the autocomplete function of the browser will affect all fields, but for some fields not being processed by 1Password extension, autocomplete can be useful. For example, fields in forms of content management.

AGAlumB

Unfortunately there isn't anything we can do about browser autofill. We always recommend disabling it because it can cause confusion and potential privacy and security risk to have sensitive information squirted into webpages automatically without user interaction, and the difficulties you're having here are just one more reason to avoid it. But if there are specific things 1Password does not currently fill for you that you'd like us to add in the future, let us know and we'll see if it's something that might be a good fit.