News for hackers. Stuff that matters.
Re:Tradle by joshstrange on Thursday March 10, 2022 @03:46PM (#30632208)
I might consider adding whatever the attribute is this week (I know it's changed over the years) to prevent auto-complete. My 1Password extension keeps trying to fill in my address on the guessing field.

EDIT: Editing the page with some of the ways to disable autocomplete [0] don't seem to be working but I'm not sure if that's because 1Password binds at page load and doesn't care what I change using DevTools. In the end this is clearly 1Password's problem [0] but I sympathize with them even as I am negatively affected by it. If they had an attribute (like lastpass) we all know the worst websites/offenders on the planet (banks, intranet sites, most financial institutions, most site asking for routing/account numbers, etc) would abuse the hell out of it. It's bad enough when they try to prevent copy/pasting in. I do think they should at least provide a way to blacklist sites where you don't want to use 1Password.

[0] https://stackoverflow.com/a/51686510/1072106

[1] https://1password.community/discussion/117501/as-a-web-devel...

Re:Tradle by divbzero on Thursday March 10, 2022 @06:04PM (#30633837)
The search field at the bottom of Hacker News is one point of reference:

  <input type="text" name="foo" autocorrect="off" spellcheck="false" autocapitalize="off" autocomplete="false">
Tradle currently uses creative but non-standard attribute values:

  <input type="string" autocomplete="nope">
Re:Tradle by dmitriid on Friday March 11, 2022 @02:56AM (#30637436)
> Tradle currently uses creative but non-standard attribute values

For autocomplete it's because Chrome unilaterally decided not to support autocomplete=off several years ago: https://bugs.chromium.org/p/chromium/issues/detail?id=914451

Re:Tradle by joshstrange on Thursday March 10, 2022 @06:21PM (#30633995)
Good call! I think part of the issue in this case is the naming of the field. I’m on mobile and can’t easily check but I thought it was something like “country” or similar. I’m guessing 1Password sees that and attaches its UI, I’m seeing my saved identity/location being suggested when I click into the field. A potential fix is to rename the field and any id/class to something that is generic/not related to location. Again, this is 1Password’s fault for sure, I’m just suggesting a way to fix it.

For 1Password it’s hard to say what the fix is. I will say, 1Password needs to a decent amount of work on their identity-filling agent/component. It is wrong more often than I’d like and will clobber fields I’ve already entered with different data. It will also fill/clobber other fields that aren’t identity-related. It mistakenly thinks a field is something that it’s not, just like in this games case. It’s too greedy or too loose in its search for field to fill. Passwords/2FA/secrets/etc is rock solid, identities? Not so much.

Re:Tradle by atombum on Thursday March 10, 2022 @04:23PM (#30632648)
I had to disable autocomplete recently, neither autocomplete="false" or autocomplete="off" worked. MDN (source below) indicates using "new-password, but in my experience passing in any random string to the autocomplete attribute did work.

https://developer.mozilla.org/en-US/docs/Web/Security/Securi...

Re:Tradle by joshstrange on Thursday March 10, 2022 @04:25PM (#30632676)
Yeah, I've taken to just generating a UUID and throwing in there as I normally have a library to do that on my frontend projects.
Re:Tradle by notatoad on Thursday March 10, 2022 @06:27PM (#30634043)
that only sort of sometimes works. chrome uses some sort of AI to look at the text displayed in a way that could visually be construed as a label and use that to identify the field for autocomplete.

the only foolproof method i've found is to use contenteditable spans instead of input tags, which has it whole own set of problems.

Re:Tradle by darekkay on Friday March 11, 2022 @01:54AM (#30637102)
> I do think they should at least provide a way to blacklist sites where you don't want to use 1Password.

Right click the page you want to block, and check out the 1Password context menu. There's an option to disable 1Password for the current page.

Re:Tradle by unfocussed_mike on Thursday March 10, 2022 @04:02PM (#30632390)
I've noticed this a whole lot recently -- a whole bunch of sites inappropriately autocompleting irrelevant things.