Banks: Protect Privacy: Disable Autocomplete with Valid HTML

Here's a little tip that might help out banks who wish to disable that pesky privacy-compromising "autocomplete" feature many browsers have on text input boxes, and may reveal people's sensitive informations on publicly used machines.

First-off, i'll point out that a public place should be the last place on earth anybody should ever do their online banking. But apparently, people do.

Kenn Christ rounds-up the controversy around using the autcomplete="off" attribute on <input ... /> elements: this attribute is not part of the HTML specification. Inserting this attribute in your HTML code makes your document an invalid HTML document.

I'm offering a fairly obvious unobtrusive JavaScript way of setting this attribute:

1. to disable autocomplete on one or several text input boxes add the following CSS class attribute value to each one: class="disableAutoComplete" so such input tag might look like: <input type="text" class="disableAutoComplete" name="mySocialSecurityNumber" value="111-11-1111"/>
2. add the following script block at the bottom of your document, say, right before the </body> tag, inline, or in a separate .js file:

   <script language="JavaScript" type="text/javascript">
   if (document.getElementsByTagName) {
   var inputElements = document.getElementsByTagName("input");
   for (i=0; inputElements[i]; i++) {
   if (inputElements[i].className && (inputElements[i].className.indexOf("disableAutoComplete") != -1)) {
   inputElements[i].setAttribute("autocomplete","off");
   }//if current input element has the disableAutoComplete class set.
   }//loop thru input elements
   }//basic DOM-happiness-check
   </script>
   

3. ...
4. let me know if it works ;]

This should ensure your HTML remains valid while still enabling the feature. Now ... if users have JavaScript disabled ... well, they shouldn't be using online banking anyway. Good online banking sites (such as Bank of America's) also use JavaScript to automatically log-out a user after a set period of inactivity on any given page.