Re: Login forms autofill

Hello Simon,

Note that we also have an additional preference - signon.autofillForms.http
- that is set to false by default.  This preference turns of autofilling
passwords on HTTP pages without user interaction.  The user has to select
the username in order for the password to be filled.  The reason this
preference was added was to prevent attacks like the one you reference.

Thanks!

~Tanvi

On Thu, Nov 2, 2017 at 10:18 AM, WhiteWinterWolf <
[email protected]> wrote:

> Le 02/11/2017 à 17:56, Gervase Markham a écrit :
>
>> On 02/11/17 11:23, WhiteWinterWolf wrote:
>>
>>> In particular, I wonder why there is an official recommendation to
>>> change `signon.autofillForms` default value while, at the same time,
>>> keeping the setting out of reach of casual users.
>>>
>>
>> The site you reference is not official, and so what is says is not an
>> official recommendation. It seems the Firefox developers have decided
>> that "true" is the correct value for this preference, and have further
>> decided it doesn't need UI.
>>
>
> Thank you for your answer. This is sad (from my personal point-of-view)
> but this makes things logical now,
>
> Regards,
> Simon.
>
> --
> WhiteWinterWolf
> https://www.whitewinterwolf.com
> _______________________________________________
> dev-security mailing list
> [email protected]
> https://lists.mozilla.org/listinfo/dev-security
>
_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security