Keepassxc-browser: [Question] Why is auto-fill considered insecure?

[christophetd]

The settings state Warning! Using auto-fill is not safe. Use at your own risk. Could you elaborate?

Thanks a bunch for this extension, it's absolutely awesome.

[droidmonkey]

There are proven cases of ad networks deploying fake hidden credential fields to steal your username and password. Disabling auto fill ensures user interaction is required to use your credentials.

[mehrdadn]

Could this be relaxed when "Automatically retrieve credentials" is disabled?
It seems kind of pointless in that case, since in that case there has already been user interaction.

[droidmonkey]

I can agree with that because to me it is cumbersome to click basically three times to fill the fields.

[runiq]

I think it'd be a good idea to put this information directly after the "Use at your own risk" warning, to give it some weight.