{"id":25038,"date":"2019-04-17T16:47:39","date_gmt":"2019-04-17T20:47:39","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=25038"},"modified":"2020-04-23T15:42:49","modified_gmt":"2020-04-23T19:42:49","slug":"safari-auto-submitting-autofilled-passwords","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2019\/04\/17\/safari-auto-submitting-autofilled-passwords\/","title":{"rendered":"Safari Auto-Submitting AutoFilled Passwords"},"content":{"rendered":"

Steve Troughton-Smith<\/a>:<\/p>\n

Safari’s new ‘submit form as soon as you choose from the autocomplete list’ is the quickest way to get locked out of your bank ever. As a universal default, that seems like such a bad idea<\/p>

[…]<\/p>

(I think the key part is that it doesn’t consider what happens if the autosaved password is wrong, and so will blind-fire at the site before giving somebody a chance to change it)<\/p><\/blockquote>\n

This has bitten me several times.<\/p>\n\n

Kyle Howells<\/a>:<\/p>\n

That same sort of ‘presume we are always right’ problem happens with the new password autosuggestion, which covers over the password field and doesn’t let you edit the suggested password anymore.<\/p>

If it guessed the password requirements wrong you can’t fix it.<\/p><\/blockquote>\n\n

Update (2019-04-18): Colin Cornaby<\/a>:<\/p>\n

I hate the way this bypasses the “Remember Me” checkboxes if you didn’t check them before autofill. From Apple’s end I’d guess the lack of cookies and cached logins is probably considered more secure though.<\/p><\/blockquote>\n\n

Andrew Abernathy<\/a>:<\/p>\n

\n

As pointed out here, this behavior makes me much more worried about getting locked out of an account.<\/p>\n

But beyond that, I dislike the interaction: there’s a “sign in” button on the page, and this preempts me from clicking on that in a way that doesn’t feel “right” to me.<\/p>\n<\/blockquote>\n\n

Update (2019-05-01): Dave DeLong<\/a>:<\/p>\n

\n

I generally really really like Safari and have very few complaints about it.<\/p>\n

However.<\/p>\n

rdar:\/\/problem\/50369660 “Safari: STOP AUTOSUBMITTING PASSWORD FORMS”<\/p>\n<\/blockquote>\n\n

Update (2019-08-20): Andrew Abernathy<\/a>:<\/p>\n

Oh, that’s<\/em> why I’ve been having to sign in to this web site every time: Safari’s autofill prompt covers the “remember me” checkbox, and Safari’s new behavior of auto-submitting credentials meant it signed in without giving me a chance to notice & check that box.<\/p><\/blockquote>\n\n

Update (2020-04-23): Jeff Johnson<\/a>:<\/p>\n

The good news is that StopTheMadness 8.0 can stop Safari from automatically submitting login forms. There’s a new website protection called “Stop autosubmit of autofilled forms”. This is disabled by default, so you’ll need to enable it manually in the StopTheMadness Website Protections. You can selectively enable the protection for individual sites, or you can enable it in the Default Website Protections for all sites. With the new protection enabled, Safari will no longer automatically submit forms. Instead, StopTheMadness will display a confirmation that asks whether you want to submit the form or cancel. If you cancel, then you can make changes to the AutoFilled form and submit manually. Note that when the confirmation is displayed, you can press the return key to submit or press the escape key to cancel if you want to avoiding clicking a button.<\/p><\/blockquote>","protected":false},"excerpt":{"rendered":"

Steve Troughton-Smith: Safari’s new ‘submit form as soon as you choose from the autocomplete list’ is the quickest way to get locked out of your bank ever. As a universal default, that seems like such a bad idea[…](I think the key part is that it doesn’t consider what happens if the autosaved password is wrong, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2019-04-17T20:47:41Z","apple_news_api_id":"ae23629b-1ad6-4ace-a143-fcd70db86c27","apple_news_api_modified_at":"2020-04-23T19:42:52Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAABA==","apple_news_api_share_url":"https:\/\/apple.news\/AriNimxrWSs6hQ_zXDbhsJw","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[30,1609,981,103,96],"class_list":["post-25038","post","type-post","status-publish","format-standard","hentry","category-technology","tag-mac","tag-macos-10-14","tag-passwords","tag-safari","tag-web"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/25038","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=25038"}],"version-history":[{"count":6,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/25038\/revisions"}],"predecessor-version":[{"id":28791,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/25038\/revisions\/28791"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=25038"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=25038"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=25038"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}