But this is fixable? iFrames can easily be detected, and they can just disable auto-fill for it?
Yes, iFrames are used by some services to log in to special websites and functions, but we could introduce a notification or some requirement of interaction for it to happen by default?
I think we should turn this on by default to protect non-technical users more.