Apple has fixed a flaw in Safari that exposed user names, email addresses, and other sensitive information when the browser visited booby-trapped websites. The update, which included an unrelated fix for a separate information disclosure vulnerability in Safari, comes a day before security researcher Jeremiah Grossman is …
A flaw in Safari? No way ...
it was an undocumented feature.
As it wasn't officially released Apple didn't choose to discuss it.
Who uses autofill anyways?
If you use autofill and remember passwords, you deserve to to have the info stolen.
Just how lazy?
I couldn't agree more.
"Security concerns are ever competing with the human necessity for convenience"
Regular users use autofill. Maybe you're not a regular user, but regular users operate in departments with names like "HR", "Accounts" and "Finance". Even if you don't give a damn about the users, you'll admit that the welfare of your employer's finance department is a Good Thing?
Now, you could say that the feature shouldn't have been provided in the first place, but if your software is more difficult and time consuming to use, than the next fellow's, then the regular users will use the next fellow's (and rememeber, in this instance, the next's fellow's remains unpatched, at this time of writing). These people's job, is to use software with names like 'SAP' and 'Sage' all day long - and they don't do it for fun. Those really are as good as software, gets, in those markets. No wonder they use things like autofill, whenever it appears that a computer is willing to do something for them, for a change.
Regular users are also the ones least likely to spot anything amiss, the least likely to attribute it to malicious intent if the do spot it, and least likely to know what to do about it, afterwards.
So, attempt to educate them, by all means, but blaming them for how they use a browser, is like blaming them for how they hold a phone.
Which would be ridiculous, no?