Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've heard of websites that have autocomplete fields that aren't visible, so extra information is captured when a user uses autocomplete (ex. a hidden address field, that is only filled in with autocomplete).

When reading the answer to Can I force Google Chrome to remember passwords? I'm wondering if this opens you up to additional phishing scams or other privacy/security holes, that wouldn't otherwise be an issue.

share|improve this question

1 Answer 1

The feature you refer is Autofill but is often called autocomplete (of forms) on a web page.

This uses a field name from the form to identify what to fill. If the 'rogue' page decides to not render this field at all you may miss seeing it. But, in most methods, the automation uses detail like the domain name to key the fields (it will not use the same password across sites just because you have the same user name).

Having said this, it is a good idea to not let critical passwords (say, your bank) be remembered by such automation mechanisms in the first place. There are a lots of ways to hijack such data from the browser, all dependent on the presently available vulnerabilities.

Example: using autofill with lastpass.
You may still choose to not use this for your critical passwords -- AmEx example regardless

Update based on comment.
The automation usually has better differentiation of phish-attempts because it is not limited to human pattern matching glitches. But, I guess we both understand that. Which leaves us with the form-auto-complete part -- let me point you to this mozilla page on turning off auto-completion for forms. Just Don't use it :-)
I think the lastpass method will be relatively more suitable.

share|improve this answer
Thank you for you answer. I know that my password to X site would only be autocompleted on X site; by 'rogue' I think you refer to pages that are phishing (pretend to look just like another page, hoping users release personal information). I'm refering to one that doesn't display all the fields, hoping users uses autocomplete and more of their personal information is filled in than they see (ex. autocomplete fills in the "first name" field, and you see that, but it also fills in the "address" or "last name" field, which you don't see). – wizlog Apr 10 '12 at 14:24
Last pass had security accident some time ago: Typically third-party password managers could be more secure as they are not part of the browser (although interact through plugins), but there is an issue with the vendor trustworthiness. – lupincho Apr 10 '12 at 14:27
about the hidden fields: with third party password managers, you typically see which fields are saved – lupincho Apr 10 '12 at 14:28
@lupincho, I've heard about that lastpass glitch. In general, I'd suggest to use these things for the typical login and form management so your head has more comfort to remember the critical ones. – nik Apr 10 '12 at 14:37
@nik, yes; I was just making a point that it replaces one issue with another; but for 'ordinary' passwords, third party managers should help address the issue as one has better control of what is saved. – lupincho Apr 10 '12 at 14:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.