Don't need no credit card to ride this train

[venta]

An question about web forms and security...

When filling in forms (I use FireFox), it's often possible to hit the down arrow and get a list of things you previously typed into that field. This is kind of handy, mostly, and results in me not having to type my name or email address out a lot.

Forms taking things like credit card details don't usually do this - for obvious reasons - and I assume the existence of some sort of 'nocache' attribute which the form-writer can set on the fields which contain information which should be a little more secure.

Except today I filled in an entire payment form (card number, expiry date, security code, the lot) from cached information based on me having filled the same form out on that website months ago. This strikes me as Not Good.

I intend to write to the site in question and tell them I think they're a bit rubbish... but I'd like to be sure I know what I'm talking about first. Am I right about the form attribute ? Am I totally wrong, and this is something which FireFox implements wrongly and the site itself can't be blamed for ?

Informed opinion welcome :)

Comments

[alien8.livejournal.com]

Don't send that email.

It's all in your browser. Under the preferences (I'm on a Mac so if you are on Doze it will vary.) Privacy, remember search and form history.

You're not the only one to have found this: http://support.mozilla.com/en-US/forum/1/7920

You can uncheck this - but this is sometimes rather handy.

So, try http://autofillforms.mozdev.org/ which will crypt the settings via your master password.

What? you haven't got one?

do it now : set a Master Password for your profile (Preferences, Security, Use a Master Password)

:)

[onebyone.livejournal.com]

There is no such attribute, although password controls generally shouldn't be auto-filled from a drop-down menu that displays the password, since that would break the rule that the text is rendered such as to hide the characters.

It's down to the user agent what is cached and how. I just switch it off, especially since I use different email addresses for different sites anyway.

In Firefox you can generally highlight a chunk of site and right-click > "View selection source" to see the HTML. It might be possible to use Firefox-specific and/or javascript tricks to prevent caching.

[zotz]

Yesterday another of my friends commented that this must mean Love accepts Oyster prepay.

[bateleur.livejournal.com]

Some of the comments above are misleading.

The behaviour you want is accomplished by setting the property autocomplete = "off" on the <form> element.