Hack 32. Allow Password Remembering

Let the browser's password manager do its job.

I'm constantly filling out forms with the same data on different sites. Firefox tries to help by remembering past values and autocompleting form fields that it recognizes, but this doesn't always work. What's worse, some sites will use a special HTML attribute to tell the browser not to remember and autocomplete specific form fields. That's fine for sensitive information, such as social security numbers and credit card numbers, but sometimes I want my browser to remember my username or password, even if the site's developers think that's unsafe.

This hack removes that special HTML attribute (autocomplete="off") from all web forms and lets me decide whether I want to let Firefox store my form data and autocomplete it later.

This script lets you trade convenience for security. Firefox does not encrypt the form data that it stores on your computer. It's up to you to understand the risks of saving your personal information and weigh those risks against the convenience of autocompletion.

4.5.1. The Code

This user script runs on all pages. First, it defines a helper function that neutralizes any autocomplete attribute on an HTML element. Then, it iterates over each form and each of its fields, calling into the helper function for the cleaning.

This feature was first available in the form of a bookmarklet, a small chunk of JavaScript embedded in a URL and saved as a bookmark. Compared to user scripts, bookmarklets are more difficult to edit and debug, and they do not execute automatically when a page loads. But bookmarklets do not require any additional software. User scripts are a natural evolution of bookmarklets.

Save the following user script as allow-password-remembering.user.js:

 // ==UserScript== // @name Allow Password Remembering // @namespace http://blog.monstuff.com/archives/cat_greasemonkey.html // @description Removes autocomplete="off" attributes // @include * // ==/UserScript== // based on code by Julien Couvreur // and included here with his gracious permission var allowAutoComplete = function(element) { var iAttrCount = element.attributes.length; for (var i = 0; i < iAttrCount; i++) { var oAttr = element.attributes[i]; if (oAttr.name == 'autocomplete') { oAttr.value = 'on'; break;  }  }  }  var forms = document.getElementsByTagName('form');  for (var i = 0; i < forms.length; i++) {   var form = forms[i];   var elements = form.elements;   allowAutoComplete(form);   for (var j = 0; j < elements.length; j++) {   allowAutoComplete(elements[j]);   }   } 

4.5.2. Running the Hack

After installing the script (Tools Install This User Script), go to http://login.passport.net and log in with your Passport account. (You can sign up for free if you dont have one.) When you submit the login form, Firefox will offer to remember your credentials for you, as shown in Figure 4-4.

Figure 4-4. password to remember

If you select Yes, Firefox will prefill your account information the next time you log into any Microsoft Passport service, such as Hotmail or MSDN.

Julien Couvreur