Auto input passphrase about kyberswap

[tranvictor]

@xupf2017 can you be more specific why it is unsafe please?

[stanxii]

@xupf2017 yes I think same, It is not safe!!!

[xupf2017]

Anybody can use my wallet send ether, without input passphrase, such as my computer is controlled by hacker.

[xupf2017]

Just like imtoken, every transaction need passphrase.

[tranvictor]

@xupf2017 you are right at some points.

[andrewsource]

@xupf2017 If you do not save passphrase when browser ask, it will not be saved in browser. If you save passphrase, anyone use your computer can capture it. It is also normal, when browser ask you to save account /password as you login in any website. In each browser, you can disable "ask to save password", Could you try it?

[xupf2017]

Yes, u r right.

[tranvictor]

@andrewsource with safari, icloud keychain is used to provide autocompleted password so someone can not just capture remembered password, he needs an icloud password to reveal the whole list. So let's disable that auto complete. It's not a good practice to auto complete crypto passphrase anw.

[andrewsource]

@tranvictor There is no standard way to disable auto complete of modern browsers. We can do the trick that insert additional hidden input (type: password, value: constant) in form. This will cause browsers ask to remember this constant password instead of our real password.

[tranvictor]

@andrewsource lets find a way to do that. They can make it in other wallets. Your suggestion might work since people will not asked to select remembered password so other inputs are not also overwritten which is a good way to prevent broadcasting errors.

[tranvictor]

There is still Safari on mac that can detect passphrase field so I will reopen this issue.

[tranvictor]

Safari autocompletion for password input doesn't update other fields hence doesn't affect the form. I will close this issue.