{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/html/issues/353","labels_url":"https://api.github.com/repos/whatwg/html/issues/353/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/html/issues/353/comments","events_url":"https://api.github.com/repos/whatwg/html/issues/353/events","html_url":"https://github.com/whatwg/html/issues/353","id":118364257,"number":353,"title":"Autofill off: consider 'must not' instead of 'should not'","user":{"login":"kennardconsulting","id":987314,"avatar_url":"https://avatars.githubusercontent.com/u/987314?v=3","gravatar_id":"","url":"https://api.github.com/users/kennardconsulting","html_url":"https://github.com/kennardconsulting","followers_url":"https://api.github.com/users/kennardconsulting/followers","following_url":"https://api.github.com/users/kennardconsulting/following{/other_user}","gists_url":"https://api.github.com/users/kennardconsulting/gists{/gist_id}","starred_url":"https://api.github.com/users/kennardconsulting/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kennardconsulting/subscriptions","organizations_url":"https://api.github.com/users/kennardconsulting/orgs","repos_url":"https://api.github.com/users/kennardconsulting/repos","events_url":"https://api.github.com/users/kennardconsulting/events{/privacy}","received_events_url":"https://api.github.com/users/kennardconsulting/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-11-23T11:40:33Z","updated_at":"2015-11-23T20:04:00Z","closed_at":null,"body":"Hi guys,\r\n\r\nThanks for the great work you do maintaining the spec!\r\n\r\nThere is a lively debate going on on the Chrome forums...\r\n\r\nhttps://code.google.com/p/chromium/issues/detail?id=468153\r\n\r\n...about how to implement 'autofill off'...\r\n\r\nhttps://html.spec.whatwg.org/multipage/forms.html#processing-model-3:autofill-field-name-9\r\n\r\nCurrently Chrome is ignoring the 'autofill off' value in many cases, and offering autofill regardless.\r\n\r\nThe debate might be settled if the spec said 'must not' offer autofill (i.e. mandatory) instead of 'should not' (i.e. recommended, but not mandatory). Is there a reason that 'autofill off' is 'should not' in the spec, as opposed to 'must not'? The examples you give (i.e. a bank website) make it clear this is a security-sensitive topic, so it would seem to benefit the user if it were mandatory?"},"comment":{"url":"https://api.github.com/repos/whatwg/html/issues/comments/159047810","html_url":"https://github.com/whatwg/html/issues/353#issuecomment-159047810","issue_url":"https://api.github.com/repos/whatwg/html/issues/353","id":159047810,"user":{"login":"kennardconsulting","id":987314,"avatar_url":"https://avatars.githubusercontent.com/u/987314?v=3","gravatar_id":"","url":"https://api.github.com/users/kennardconsulting","html_url":"https://github.com/kennardconsulting","followers_url":"https://api.github.com/users/kennardconsulting/followers","following_url":"https://api.github.com/users/kennardconsulting/following{/other_user}","gists_url":"https://api.github.com/users/kennardconsulting/gists{/gist_id}","starred_url":"https://api.github.com/users/kennardconsulting/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kennardconsulting/subscriptions","organizations_url":"https://api.github.com/users/kennardconsulting/orgs","repos_url":"https://api.github.com/users/kennardconsulting/repos","events_url":"https://api.github.com/users/kennardconsulting/events{/privacy}","received_events_url":"https://api.github.com/users/kennardconsulting/received_events","type":"User","site_admin":false},"created_at":"2015-11-23T20:03:59Z","updated_at":"2015-11-23T20:03:59Z","body":"annevk,\r\n\r\nThanks for your reply. To clarify: I'm not asking for the specification to mandate any particular kind of UI. I'm just asking if the specification can mandate that the browser respect 'autofill off' to *disable* a UI.\r\n\r\nThere are many precedents for this in the spec. For example (emphasis mine):\r\n\r\n> A form control that is disabled *must* prevent any click events\r\n> The readonly attribute... When specified, the element *is not* mutable\r\n> The required attribute... When specified, the element *is* required\r\n\r\nNone of these are 'may' or 'should be' (which is quite sensible, IMHO).\r\n"}}