Don't we have AI by now that can figure out what button to click to change the password?
A well-known URL for changing passwords
131–140 of 179 posts
Re: A well-known URL for changing passwords
#132That looks like a good idea, but why not go one step further? Provide a common API interface for password changes. Think about it: If you assume your pw manager database is compromised - what do you do? Go to a hundred webpages and change your password? probably not. Your PW Manager can't provide a feature to do it for you. But it could if there was such an API.
And while we're at it just a common authentication API for http all together, with negotiable features like basic auth/form auth/session cookie/jwt/oauth/api token/csrf location/etc. Then we can make clients for every language to just log in to a website if you have the credentials. Web browsers could have a secure authentication widget that bypasses whatever the website has built in. It would be glorious
Don’t forget CORBA support! It’s a must have.
Re: A well-known URL for changing passwords
#133This is a nice simple convenience feature, for sure [1]: > example.com provides a /.well-known/change-password resource which redirects to their change password form, wherever it happens to already be. > Password managers check for the existence of /.well-known/change-password on https://example.com . > If it's there (the response code is 2xx or 3xx), the password manager can cause the user's browser to navigate ther…
How about something like: /.well-known/delete-account /.well-known/request-user-data This would also be nice as we wouldn't need things like https://justdelete.me
Yeah, no way these things will take off without legislation.
And regarding more legislation, no thanks.
Re: A well-known URL for changing passwords
#134Earlier quoted context omitted.
How about something like: /.well-known/delete-account /.well-known/request-user-data This would also be nice as we wouldn't need things like https://justdelete.me
I can't imagine those taking off without legislation. Making it easier to change passwords is more or less in the interest of the companies who make web sites; making it easier to delete accounts or export all of your data, by comparison, is not.
Well, yes. I was solely looking from a user's perspective.
Re: A well-known URL for changing passwords
#135Earlier quoted context omitted.
On that note though, if we start using standard APIs for this sort of thing, I question whether we should just go farther and "solve" the problem. Ie, as a dumb example, why should I expect them to implement an API for my password manager, and instead not simply allow oauth where my pass manager becomes my token provider? Doesn't that fake example solve both problems, while also getting rid of bizarre password churn?…
I think you answer yourself already. You expect this: > simply allow oauth where my pass manager becomes my token provider to be a simpler implementation then "PUT https://blabla.com/change-password" or whatever a password change request would look like?
I'm not sure if I misunderstand what you are getting at but if you are talking about the .well-known/change-password thing that in this post, its just a well known _redirect_ to the regular change password page for that particular website, you cant PUT to it, it requires a human to navigate the page and fill out the password change form.
Unfortunately its not a well-known api endpoint.
Re: A well-known URL for changing passwords
#136> If it's there (the response code is 2xx or 3xx), the password manager can cause the user's browser to navigate there when the user indicates they'd like to change their password.
The primary issue I see here is that there are a lot of websites that do 301 redirects from either non-www to www subdomain or non-https to https, would this not confuse the password managers in assuming there is a .well-known even though it’s just a benign redirect?
Re: A well-known URL for changing passwords
#137How about a well-known URL for unsubscribe?
Re: A well-known URL for changing passwords
#138One thing I really wish when it comes to Firefox Containers if I create a container for Gmail and am logged into Google I want all the email links (mailto:) to open in that container. I know currently you can have all the sites with a specific URL to open in specific containers but I'm not sure if there is a way to open various protocols in separate containers.
Re: A well-known URL for changing passwords
#139Earlier quoted context omitted.
They already do things the way they want. TFA doesn't change that. This kind of spec doesn't and shouldn't specify UX. It's simply "where do your users go to change passwords?" with a simple reply of "Here: $URL".
It's actually only relevant to UX. It's not useful as an API call. You can't feed it any data, and it doesn't provide anything but a single URL redirect. It will just become a big "Change Password" button on a password manager. In order to change the password, you have to be logged in. So the website will have to redirect the user to a log-in form, passing along the change-password form URL when authentication succee…
I think you are confusing the applicable scope of what the proposal implements with something else you'd like to see implemented.
This is not even an API. It is merely a proposal that wherever your change-password form lives, people should be able to get to it via this specific path, too. Perhaps this whole thing is a terrible idea, but either way the problem they're trying to solve is different than the problem you're trying to solve.
Re: A well-known URL for changing passwords
#140Earlier quoted context omitted.
Found documentation on it for you: https://developer.apple.com/library/archive/documentation/Ge...
The discussion was about specs/standards for .Well-Known. I pointed out that Apple's isn't in the list. In that context I don't follow why you think linking to Apple's development guide helps clarify anything? It still isn't a specified standard, and still isn't on the list of them.
It really has no utility outside of Apple's app ecosystem, so why would you want it to become a standard?