Don't need no credit card to ride this train

[venta]

An question about web forms and security

Comments

[alien8]

Don't send that email.

It's all in your browser. Under the preferences (I'm on a Mac so if you are on Doze it will vary.) Privacy, remember search and form history.

You're not the only one to have found this: http://support.mozilla.com/en-US/forum/1/7920

You can uncheck this - but this is sometimes rather handy.

So, try http://autofillforms.mozdev.org/ which will crypt the settings via your master password.

What? you haven't got one?

do it now : set a Master Password for your profile (Preferences, Security, Use a Master Password)

:)

[venta]

It's all in your browser.

While I'm happy to accept that, that doesn't really explain why credit card forms normally *don't* cache the information, but this specific one does.

What? you haven't got one?

I haven't, no. No one uses my laptop but me, and the log-on is password protected. It's locked when I'm away from it, and thus a master password doesn't really seem to bring much to the party.

I'm curious about the autofillforms, so will experiment with it.

[venta]

It's all in your browser. Under the preferences (I'm on a Mac so if you are on Doze it will vary.) Privacy, remember search and form history.

Just in case anyone else is reading this and fancies trying it, the Windows settings are:

Tools->Options->Privacy, set "Firefox will..." to "Use custom settings for history" to see the "Remember search and form history" checkbox.

Tools->Options->Security for the master password option.

[onebyone]

There is no such attribute, although password controls generally shouldn't be auto-filled from a drop-down menu that displays the password, since that would break the rule that the text is rendered such as to hide the characters.

It's down to the user agent what is cached and how. I just switch it off, especially since I use different email addresses for different sites anyway.

In Firefox you can generally highlight a chunk of site and right-click > "View selection source" to see the HTML. It might be possible to use Firefox-specific and/or javascript tricks to prevent caching.

[zotz]

Yesterday another of my friends commented that this must mean Love accepts Oyster prepay.

[venta]

Er.... what?

[valkyriekaren]

Your subject line.

[venta]

Ah. I promptly forgot about that and tried to apply zotz comments to web forms :)

[bateleur]

Some of the comments above are misleading.

The behaviour you want is accomplished by setting the property autocomplete = "off" on the

[venta]

Aha. Thank you. That explains why credit card forms don't usually display such things. Of course, the above suggestions sound sensible to me anyway, but it's nice to have that mystery cleared up.

[bateleur]

the above suggestions sound sensible to me anyway

Well... maybe. There's always a trade-off between security and convenience. I do think it would be reasonable to contact the site and ask them to improve their form.

[alien8]

..and there's nothing to stop a malicious site asking for the same data from your browser.. best not to have it in there.

IMHO Edit your saved data to pull the number.