Remove Password Autocomplete in credential dialog about lyo.server HOT 2 CLOSED

I think users are free to use autocomplete. If a company wants to use Lyo in a PCI compliant system, we can have a separate discussion with them (but I believe they will have 100% own GUI). XSS (and CSRF) protection must be enabled on the website anyway. If the attacker got access to the browser and can visit any page and read its DOM, I think it's game over (use 2FA to mitigate that).

I am personally mad at all people who use this attribute and have https://chrome.google.com/webstore/detail/force-autocomplete/piechbhjioolbecaioglhamjjjkmbchj?hl=en-US installed to render such attempts to disable autocomplete void. And no, I am not going to "retype" my email twice w/o autocomplete because some bank thinks I can make a typo there. Ditto for _blank attributes that do not allow me control over the left/middle button use https://chrome.google.com/webstore/detail/death-to-blank/gneobebnilffgkejpfhlgkmpkipgbcno?hl=en-US and pages that try to disable paste on email/password fields (https://chrome.google.com/webstore/detail/dont-fuck-with-paste/nkgllhigpcljnhoakjkgaieabnkmgdkb?hl=en-US)

from lyo.server.

Wontfix, OWASP no longer requires this https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005)

from lyo.server.