Remove autocomplete="off" from the password field

[cvan]

Per this comment by @ckarlof, perhaps it's worth revisiting the autocomplete="off".

When signing up for a Marketplace account, I was surprised to not see my email address be autocompleted. Then, when setting up a Firefox Accounts account for Loop, I noticed the same thing.

[ckarlof]

Yeah, we have it on our "plaintext" password field for good reason (the browser shouldn't remember your passwords outside the password manager), but it would probably be a good idea to remove it on the email field.

[ckarlof]

Duplicate of #1203.

[ckarlof]

Using this to track removing autocomplete=off from the password field and using #1203 to track removing it from the username field.

We need to keep autocomplete=off on the field that shows the user's "unmasked" password, otherwise it will end up in the autocomplete DB (see #783).

These issues are separate because removing autocomplete=off on the password field could cause a regression in "don't offer me to set up Sync while I'm setting up Sync issue". There are better solutions than using autocomplete=off, but we should have those in place before we removeautocomplete=off` from our password field.

[cvan]

Yeah, we have it on our "plaintext" password field for good reason (the browser shouldn't remember your passwords outside the password manager), but it would probably be a good idea to remove it on the email field.

If the plaintext field is visible, how about having the <input type="text" autocomplete="off"> element change to <input type="password"> upon form submit?

[ckarlof]

It's not clear the specific signals the browser is relying on to save form data. Having autocomplete="off" only on the text input (but not on the password input) may be sufficient (without needing to do the visual switch).

[cvan]

I did an experiment:

http://jsbin.com/mugeh/1/edit?html,js,output

[ckarlof]

@shane-tomlinson, wanna take a crack at this?

Here is the necessary history and context:

• #784 and #783
• #363

Here's what I propose:

• Revert the behavior to something like what was done in #363, which only puts autocomplete=off on the password field when we're logging into Sync
• Remove autocomplete=off on the email input (fixes #1203)
• Make sure we never submit the form with the "visible password" input shown or make sure it has autocomplete=off, so we don't get a regression on #783. (See what @cvan did in #1788 (comment).)

[ckarlof]

This work might also address #1780.

[shane-tomlinson]

Remove autocomplete=off on the email input (fixes #1203)

None of the email fields had the autocomplete attribute - see #1203 (comment), closed #1203