Mailing-List: contact notifications-help@accumulo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: jira@apache.org
Date: Thu, 3 Aug 2017 17:23:00 +0000 (UTC)
From: "Josh Elser (JIRA)" <jira@apache.org>
To: notifications@accumulo.apache.org
Message-ID: <JIRA.13090874.1501270752000.86448.1501780980422@Atlassian.JIRA>
In-Reply-To: <JIRA.13090874.1501270752000@Atlassian.JIRA>
References: <JIRA.13090874.1501270752000@Atlassian.JIRA> <JIRA.13090874.1501270752552@jira-lw-us.apache.org>
Subject: [jira] [Resolved] (ACCUMULO-4688) Consider adding
 autocomplete=false to the shell servlet's password input element
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Thu, 03 Aug 2017 17:23:04 -0000


     [ https://issues.apache.org/jira/browse/ACCUMULO-4688?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Josh Elser resolved ACCUMULO-4688.
----------------------------------
       Resolution: Won't Fix
    Fix Version/s:     (was: 1.7.4)
                       (was: 1.8.2)

Leaving this one as "Won't Fix". If those in favor can give a better argument, we can revisit it later.

> Consider adding autocomplete=false to the shell servlet's password input element
> --------------------------------------------------------------------------------
>
>                 Key: ACCUMULO-4688
>                 URL: https://issues.apache.org/jira/browse/ACCUMULO-4688
>             Project: Accumulo
>          Issue Type: Improvement
>          Components: monitor
>            Reporter: Josh Elser
>            Assignee: Josh Elser
>            Priority: Trivial
>          Time Spent: 0.5h
>  Remaining Estimate: 0h
>
> Had a report from a user which identified an 'issue" in the ShellServlet around the password input element.
> There is an attribute {{autocomplete}} which can be set to false on the {{input}} element that will instruct browsers to not try to save the password in some store. In theory, this marginally improves security as the password would not be stored on the local machine in (potentially) some way that could be accessed by an adversary.
> I'm on the fence about the value of making this change (if the browser doesn't do this automatically, users would probably do this on their own in a way that is *less* secure than how the browser could). Thoughts from everyone else?


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)