Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

On Microsoft's Live single sign on system they seem to employ some kind of trickery to prevent browsers from wanting to save passwords. (Or at the very least Firefox behaves as such). I have the Password Saver bookmarklet that manipulates autocomplete on forms/fields to not dissuade the browser from asking me to save my credentials however this doesn't seem to have any impact with Live.

share|improve this question

2 Answers 2

up vote 4 down vote accepted

They're probably changing the field names in the HTML code each time someone visits the page. When Mozilla's, Opera's, or other browsers try to save the "password" type input field data, they also save the field name as defined in the "name" value of the relevant HTML "input" tag.

If the "name" field (which the user doesn't see) always includes a changing (unique or random?) number, for example, then this will throw these systems off since they'll be expecting the same previously stored input field name (and not finding it) upon return visits.

This is a technique that I find to be rarely used on web sites where the webmaster considers these "remember password" features in web browsers to be a serious security risk.

share|improve this answer
1  
While I haven't gone and verified this, this most certainly sounds plausible and terrible for user experience. I hate when websites feel "they know better" than their own users. My firefox passwords are encrypted with a secure (and totally unique) password, I'm not at all concerned about password theft. –  Chris Marisic Jul 5 '11 at 15:05
3  
Now this is a tactic I need to start remembering to place on credit card fields, that's something that always makes my skin crawl where I click into a CC box and see auto complete answer with my CC in plain text. –  Chris Marisic Jul 5 '11 at 15:07
1  
+1 because this technique makes perfect sense for input fields designed for credit card numbers. –  Randolf Richardson Jul 5 '11 at 20:48
2  
@Chris This would make the credit card problem worse. The browser will now not only remember the one credit card, but remember it again every time you have to re-enter it for the same site. It'll be just that much easier to spot a stray number. Just because you don't see it, doesn't mean it's not saved away somewhere. –  Joel Coehoorn Jul 28 '11 at 3:02
3  
@Joel Coehoorn if a virus is stealing the auto complete file and the card number is in it that doesn't matter whether it's there 500x or once, it does however prevent a user from sitting down at your computer and double clicking a field on an e-commerce site and magically see your card appear. –  Chris Marisic Jul 28 '11 at 12:17

I found the following code by selecting the Windows Live ID input field, right-clicking it, and selecting View Selection Source under Firefox:

<input class="cssTextInput" autocomplete="off" maxlength="113" id="i0116" name="login" type="text">

The autocomplete="off" code may be responsible for this behavior. See Mozilla Developer Network: How to Turn Off the Autocompletion Feature. It is likely that there is further CSS code intended to defeat attempts to bypass this code.

share|improve this answer
1  
Has to be something else as well - the password saver bookmarklet automatically removes autocomplete="off" through DOM manipulation. –  Stephanie Jul 28 '11 at 3:17
    
I went as far as hacking my Firefox nsloginmanager.js to change where Firefox checks whether autocomplete=off on an element to just return false (or true whichever was needed I can't remember) to absolutely destroy the autocomplete=off "feature" that I loathe. websites should not be able to dictate to browsers if I want to opt out, it annoyed me massively how much work I had to do to disable that. It should be in about:config, but this isn't the FF forums that my complains will matter. –  Chris Marisic Jul 28 '11 at 12:15
1  
So any idea what the code preventing the login credentials from being stored is? –  DragonLord Jul 28 '11 at 13:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.