Google-discovered vulnerability in Bitwarden

If this is the only reason, then it seems that the main drawback of preventing Bitwarden from auto-filling invisible fields would be that the user has to auto-fill twice (once on the username field, and again on the password field), and that it is possible the “autofill on page load” may not work for the password field, requiring a manual auto-fill (Ctrl+Shift+L, etc.) there.

Personally, I always use Ctrl+Shift+L for security reasons, and having to hit this keyboard shortcut twice would be a negligible price to pay for the peace of mind of knowing that only the visible fields are being auto-filled. In fact, I find it a bit unnerving when I auto-fill my username, and then see that the password is already filled when I get to the password screen (which I have discussed in detail in my analysis on Preventing Amazon from “stealing” password).

Thus, if this usability issue is the only thing standing in the way of a more secure auto-fill, then I think that users should be given the option of disabling auto-fill of hidden fields. I am encouraged to learn from your response that there are no technical hurdles standing in the way of such a feature.

1 Like