Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A well-known URL for changing passwords

github.com

Post reply on HN
Print view View original

81–90 of 179 posts

Re: A well-known URL for changing passwords

#81

Post by johnjohnsmith »

WorldMaker wrote: post #72
buster wrote: post #64

Earlier quoted context omitted.

> How do you stop replay and man-in-the-middle attacks? Replay what? Me setting my password over HTTPS? How? The sample URL was deliberately just an example. It would surely need more thought but i'm pretty sure the "PUT ..." solution is simpler then throwing oAuth at the problem. So you're confident that the same people who can't secure the simple PUT request are better suited to implement the custom oAuth solution…

I'm saying that the closest thing we have to a well-adopted standard for securing a "simple PUT request" for something as security critical as a password is called OAuth. You need CSRF tokens to avoid replay attacks. You need some way for an app to Authorize: that they have permission to update someone's password. That's probably some sort of application whitelist. That application whitelist probably needs a permissi…

"That application whitelist probably needs a permissions flow for a user to agree that Password Manager Brand X is indeed their password manager application of choice."

This scares me. Are you proposing it as something that is necessary, or something that is necessary as part of the parent poster's suggestion to use HTTPS + PUT? If the former, how does this scale across the multiple platforms I use? Ugh. Scary.

Re: A well-known URL for changing passwords

#82

Post by TazeTSchnitzel »

ghostly_s wrote: post #78

From the spec: > Servers must not locate the actual change password page at the change password url, per RFC5785 §1.1 Appropriate Use of Well-Known URIs. I scanned the RFC but can't fine the prohibition against this. Curious, why does it matter? Just because .well-known URLs are not meant to be exposed to the user?

That section says:

   There are a number of possible ways that applications could use Well-
   known URIs.  However, in keeping with the Architecture of the World-
   Wide Web [W3C.REC-webarch-20041215], well-known URIs are not intended
   for general information retrieval or establishment of large URI
   namespaces on the Web.  Rather, they are designed to facilitate
   discovery of information on a site when it isn't practical to use
   other mechanisms; for example, when discovering policy that needs to
   be evaluated before a resource is accessed, or when using multiple
   round-trips is judged detrimental to performance.
I am guessing they consider “general information retrieval” and “URI namespaces” to exclude it.

Re: A well-known URL for changing passwords

#83

Post by notatoad »

hannob wrote: post #10

That looks like a good idea, but why not go one step further? Provide a common API interface for password changes. Think about it: If you assume your pw manager database is compromised - what do you do? Go to a hundred webpages and change your password? probably not. Your PW Manager can't provide a feature to do it for you. But it could if there was such an API.

This is the sort of scope creep that stops good things from happening. Sure, a full api for password changes sounds great. But why is that related to this project at all?

This project is something that will take approximately 5 minutes to implement, and probably not much more to design the "spec" in the first place. and as is, it does something worthwhile. A huge complex project in a related area isn't a replacement or an alternative, just a tangentially related thing that should have no bearing on this project. A .well-known url for password changes can provide real benefit for real people now, even though it doesn't do everything.

Re: A well-known URL for changing passwords

#84

Post by peterwwillis »

WorldMaker wrote: post #49
peterwwillis wrote: post #28

Here is the actual spec: https://wicg.github.io/change-password-url/index.html Presumably this is only for accounts you are already logged into and want to change the password of, since change password forms usually aren't accessible unless you are already logged in. However, the same domain may involve multiple account types. AWS and other popular websites have multiple types of accounts, different login methods, an…

Where it links would be up to the website. The password manager doesn't know if you are already logged in or not, just that the user requested an intent to change their password at example.com. The password manager should just open the URL in the user's default browser. Then it's up to the website itself to redirect to a login flow if need be (they don't have a logged in cookie on that browser), including the passwor…

If every website has to "figure out" how to "do the right thing", do you just assume they'll all do the same thing in the same way? I think they'll all come up with different ways to solve the problems, which will result in a different user experience for each site. So users will have to do something different on every site when they want to change their password.

So it'll be the same as it is now, except that there's a button to start the process of doing the non-standard thing. I think a little bit of extra work on the standard could result in a more standard experience, and less work for the user.

Re: A well-known URL for changing passwords

#85

Post by [deleted] »

asdkhadsj wrote: post #18
hannob wrote: post #10

That looks like a good idea, but why not go one step further? Provide a common API interface for password changes. Think about it: If you assume your pw manager database is compromised - what do you do? Go to a hundred webpages and change your password? probably not. Your PW Manager can't provide a feature to do it for you. But it could if there was such an API.

On that note though, if we start using standard APIs for this sort of thing, I question whether we should just go farther and "solve" the problem. Ie, as a dumb example, why should I expect them to implement an API for my password manager, and instead not simply allow oauth where my pass manager becomes my token provider? Doesn't that fake example solve both problems, while also getting rid of bizarre password churn?…

[deleted]

Re: A well-known URL for changing passwords

#86

Post by tedunangst »

nine_k wrote: post #56
peterwwillis wrote: post #28

Here is the actual spec: https://wicg.github.io/change-password-url/index.html Presumably this is only for accounts you are already logged into and want to change the password of, since change password forms usually aren't accessible unless you are already logged in. However, the same domain may involve multiple account types. AWS and other popular websites have multiple types of accounts, different login methods, an…

I wonder if URLs like /.well-known/login and /.well-known/logout would be a good idea, and should belong to a similar spec. Maybe even /.well-known/register, too.

Also .well-known/change-profile and .well-known/post-comment and .well-known/add-to-cart.

Re: A well-known URL for changing passwords

#87

Post by groestl »

hannob wrote: post #10

That looks like a good idea, but why not go one step further? Provide a common API interface for password changes. Think about it: If you assume your pw manager database is compromised - what do you do? Go to a hundred webpages and change your password? probably not. Your PW Manager can't provide a feature to do it for you. But it could if there was such an API.

Because it's a hard problem to solve, not technology-wise, but due to people. So it's best solved one step at a time. And a bait-and-switch model might just do it: First, overcome initial organizational inertia by a dead simple spec. It's so simple, an admin can implement it without asking anyone else for resources.

When it's done, the website is a good citizen to password managers, everyone is happy.

At some point, extend the spec, and display complying websites with a nice symbol. Then, after a while, display non-complying websites with a bad symbol. And a decade later, we're done ;)

Re: A well-known URL for changing passwords

#89

Post by CuriousSkeptic »

nine_k wrote: post #56
peterwwillis wrote: post #28

Here is the actual spec: https://wicg.github.io/change-password-url/index.html Presumably this is only for accounts you are already logged into and want to change the password of, since change password forms usually aren't accessible unless you are already logged in. However, the same domain may involve multiple account types. AWS and other popular websites have multiple types of accounts, different login methods, an…

I wonder if URLs like /.well-known/login and /.well-known/logout would be a good idea, and should belong to a similar spec. Maybe even /.well-known/register, too.

There is, kind of, https://openid.net/specs/openid-connect-frontchannel-1_0.htm...

Re: A well-known URL for changing passwords

#90

Post by Piskvorrr »

0xfeba wrote: post #50
gwbas1c wrote: post #48

The real problem is that every single site needs its own separate password. (Even worse are products and services where you need a separate password for different features.) The better way to solve this is to push for better account portability. We already (kind-of) have this with websites that let you sign in with your Google or Facebook ID. (Unfortunately, these systems still have privacy problems because they shar…

https://www.grc.com/sqrl/sqrl.htm Though I think he will need a more convincing marketing site if he intends for people to try it out.

GRC is not known for giving much importance to marketing.
Post reply on HN