I have a public-facing website that is used to manage business infrastructure equipment for my clients. A security breach on this website could cause expensive problems for clients.
A number of different websites–mostly banks, health care, and government–disable the "save password" dialog from appearing in Firefox, IE, and other browsers citing security concerns. I'm talking about the box/bar that appears after you enter your login information, so the browser can auto-populate the username/password fields for you the next time your visit that site.
My question is not how to disable, because that is answered in the Disable browser 'Save Password' functionality question.
What I want to know is:
- What are some cases in which it is absolutely essential to disable "save password" functionality? Do such cases exist?
- Does this technique really provide any additional security? In other words, won't people find a way to leak their passwords despite your best efforts?
- Do users complain about removal of "save password" functionality?
- Any other thoughts on when to disable "save password" functionality?
Best Answer
I complain about it ;-) I was actually just thinking about this today because my online banking site disables password autocompletion and it's really irritating.
While not a majority of computer users, there are plenty of people who know how to manage their passwords securely, and for them it's really irritating when websites disable the password field autocompletion because it means they need to do something like, say, writing the password down, or picking a simple one that's easy to remember - neither of which makes them happy, because as I said, these are people who take password security seriously. Using a browser's password manager is pretty much the best compromise between security and convenience we have. And the annoying part is, if a website tries to disable autocompletion there's no easy way to tell some browsers to ignore that. (In Firefox it requires hacking some Javascript file)
This also ties into the thing Joel once wrote about how users, erm, people like to be in control of their environment. They're much less likely to use (or at least like) a program or website that takes it upon itself to decide that they can't be trusted with a password manager.