As a pen test highlighted the same issue as this thread https://www.mojoportal.com/Forums/Thread.aspx?pageid=5&t=11623~1 I tried out the promised setting

<add key="DisableAutoCompleteOnLogin" value="true"/>

but it doesn't appear to make any difference.

?

that's what I was expecting, but in fact I get this on /secure/login.aspx...

<input name="ctl00$mainContent$login1$LoginCtrl$Password" type="password" id="ctl00_mainContent_login1_LoginCtrl_Password" class="normaltextbox passwordbox" />

I'm using latest mojoPortal version 2.4.0.9

I have tried on another 2.4.0.9 site and the setting had no effect. I'll try it in dev environment when I get a chance.

look to see if the config setting exists in more than one place, if it does the one lower in the file wins, user.config is "lower" than Web.config so user.config wins over web.config but it could be in user.config more than once and the bottom one wins

yay, now working after upgrading site to latest pull of source code (2.4.0.9 plus...). The version of mojoportal.web.dll I upgraded from dated to 03 January 2015.