Does IE 11 ignore autocomplete="off"?

Question

I'm working on a mature ASP.NET/C# application (it's about three years old). For various reasons I've recently begun using the beta IE 11. However, when I first fired up the app in the browser, I noticed that it asked me if I wanted Internet Explorer to remember the password for this site. This doesn't happen in any other browser the app supports, or other versions of IE, due to the presence of autocomplete="off" e.g.

<form id="form1" runat="server" autocomplete="off">

Is this skunked in IE 11 (which I know is only beta, but I'm a bit worried about it)?

Answer 1

Yes, IE11 deliberately ignores this attribute on password fields (demo in the 3rd section of this page http://enhanceie.com/test/password/passwordautocomplete.asp).

Password managers encourage strong, unique password creation per site. Unique, strong passwords are difficult to remember and type on touch devices for each site, so users rely on their password manager. IE11 still honors the autocomplete=off attribute on all other AutoComplete input elements (e.g. name, address, credit cards, usernames, phone, etc).

These old blog posts might set some context: https://blogs.msdn.microsoft.com/ieinternals/2009/09/10/why-wont-ie-remember-my-login-info/ http://blogs.msdn.com/b/ieinternals/archive/2009/06/03/slowing-down-disabling-accelerators.aspx

Summarized: When the browser doesn't offer to autocomplete a password, the user assumes that the browser is broken. They then either use another browser which ignores the attribute, or install a password manager plugin that ignores the attribute.

Note: In addition to disabling autocomplete=off, IE11 will also "autofill" the password if certain conditions are met-- see http://msdn.microsoft.com/en-us/library/ie/dn629640(v=vs.85).aspx for details.