We should support the Moz pref to ignore autocomplete=off, but currently don't since we use our own implementation. This may well be too subtle for a GUI pref, but we should at least honor it as a hidden pref.

in what cases would we do this? we don't want to allow overriding.

> we don't want to allow overriding. Um... why not? If a user is finding and changing a hidden pref, they are taking responsibility for their own actions. Ultimately, the browser is the user's tool, and if the user feels that keychain provides them with enough security for their online bank, why should we prevent them from keeping it there (as opposed to, say, on a stick note). Besides, some sites abuse autocomplete=off, using it even if there is no serious security risk to someone else accessing the account. Why should we prevent knowledgable users from making their own determinations as to which sites are safe to store in their keychains, rather than allowing any site to do so at their whim? (See bug 124065 for the discussion of creating the pref in Netscape.)

because banks have made it very clear they don't want to give users that power, at the risk of blocking us. i guess moz does have this hidden pref, though that amazes me. i'll talk to asa later today.

after talking with asa, i guess if mozilla does it, it's ok for us to do it too. i guess we should re-use the prefname even if it's a different system, right?

> i guess we should re-use the prefname even if it's a different system, right? That was my thought, since the effect appears to be exactly the same. Using the same pref eases transitions from other Moz browsers, makes user-discovery of the pref more likely, and means one less new pref to add to an already very large list.

Josh is rewwritting the prefs at the momment so I'm ccing him.

we should look at this sooner, it doesn't really have much to do with the prefs rewrite.

Fixes the patch so it applies to latest CVS, also don't bail if pref service is unavailable. If pref service is unavailable, just use false for the pref. No reason to bail.

Comment on attachment 164511 [details] [diff] [review] updated and improved patch v2.0 sr=pinkerton

landed on trunk

Should this be working in 2004110508 (v0.8+)? It doesn't at a site (ba-ca.com) on which it does using Firefox.

We have issues with frames. It probably won't work on a frames site. I don't know what the issues are, and it should be a separate bug anyway.

Frames problem filed as bug 273239.