YES, this is what I have been waiting for. A month ago I lost a USB with my keepass file on it. The file is encrypted with a good password but I would feel better if I could reset all my passwords just in case but that would take me days.
A well-known URL for changing passwords
151–160 of 179 posts
Re: A well-known URL for changing passwords
#152Earlier quoted context omitted.
How about something like: /.well-known/delete-account /.well-known/request-user-data This would also be nice as we wouldn't need things like https://justdelete.me
I can't imagine those taking off without legislation. Making it easier to change passwords is more or less in the interest of the companies who make web sites; making it easier to delete accounts or export all of your data, by comparison, is not.
> making it easier to delete accounts or export all of your data, by comparison, is not.
Isn't this mandated to be present and accessible by the GDPR anyway?
Re: A well-known URL for changing passwords
#153Earlier quoted context omitted.
You're clearly far too deep into the oAuth mindset: - You don't need "persmissin flows" - You don't need "to update *someone's password" (just your own!) - You don't need an "application whitelist" because HTTP doesn't know what an application is All you need is to say "hey, here is my current password/hash. Update it to this one." on a secure channel (let's say, HTTPS). Alternatively "Hey, i am XYZ and this cookie t…
You're clearly not thinking of repercussions of having an open REST endpoint that anyone on the internet could just curl/postman/httpie to change someone's password. Good password change forms have had CSRF tokens for decades now: https://en.wiktionary.org/wiki/CSRF_token There are many known attacks whereby an attacker changes someone's password to control an account. I don't care about OAuth at all. It's not an "OA…
> that anyone on the internet could just curl/postman/httpie to change someone's password.
But that's my point. Keep it simple, let my password manager (be it on my mobile, laptop or whereever i want) change my password! Yes, i'd like that.
You don't even need that CSRF token, i don't know why. To prove your identity you'll only need to prove that you know you your password. That's possible, securely. See https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco... and https://en.wikipedia.org/wiki/Zero-knowledge_password_proof
Why do you need an application whitelist?! The website i am visiting isn't whitelisting my browser, so why would it need to whitelist my password manager?
Re: A well-known URL for changing passwords
#154Earlier quoted context omitted.
I can't imagine those taking off without legislation. Making it easier to change passwords is more or less in the interest of the companies who make web sites; making it easier to delete accounts or export all of your data, by comparison, is not.
> making it easier to delete accounts or export all of your data, by comparison, is not. Isn't this mandated to be present and accessible by the GDPR anyway?
Yes but present and accessible is a low bar. For most companies you have to email support to make this happen.
Re: A well-known URL for changing passwords
#155I wish every site would just use emailed sign-in links instead of passwords. We wouldn't have to deal with all these password relative nonsenses - password managers, .well-knowns, password requirements, password resets, weak passwords, gazilion passwords in my head. Everything would be so much simpler
Re: A well-known URL for changing passwords
#156Earlier quoted context omitted.
How about something like: /.well-known/delete-account /.well-known/request-user-data This would also be nice as we wouldn't need things like https://justdelete.me
I can't imagine those taking off without legislation. Making it easier to change passwords is more or less in the interest of the companies who make web sites; making it easier to delete accounts or export all of your data, by comparison, is not.
I can't imagine it either, but I wish we could try to establish things like these as having signalling value. Adding a redirect there is as trivial as it could possibly be, so if this could get established as "best practice", then there would be no excuse for companies not to support it.
Ultimately, not having a clear and easy policy for cancelling the service and deleting the account only happens when the company is malicious, and attempts to exploit the user. Having this visible plain as day is something I'd love.
Re: A well-known URL for changing passwords
#157Earlier quoted context omitted.
How about something like: /.well-known/delete-account /.well-known/request-user-data This would also be nice as we wouldn't need things like https://justdelete.me
I can't imagine those taking off without legislation. Making it easier to change passwords is more or less in the interest of the companies who make web sites; making it easier to delete accounts or export all of your data, by comparison, is not.
Until users decide that the businesses interests of the companies that run the websites they use are less important than their own interests these features will never catch on. How about we stop using websites that fail to implement things that are good for us?
In fact, someone could write a browser plugin to put a screen between the user and the website that states "This website fails to implement .well-known link. Are you sure you want to continue?" like Chrome does for sites that have borked DNS. If a reasonably large number of people used that you'd see lots of sites implement this idea without needing regulations. I'd use that.
Re: A well-known URL for changing passwords
#158Earlier quoted context omitted.
How about something like: /.well-known/delete-account /.well-known/request-user-data This would also be nice as we wouldn't need things like https://justdelete.me
I can't imagine those taking off without legislation. Making it easier to change passwords is more or less in the interest of the companies who make web sites; making it easier to delete accounts or export all of your data, by comparison, is not.
My employer would have no problem with it.
We are a non profit, and don't run from user donations.
Re: A well-known URL for changing passwords
#159I wish every site would just use emailed sign-in links instead of passwords. We wouldn't have to deal with all these password relative nonsenses - password managers, .well-knowns, password requirements, password resets, weak passwords, gazilion passwords in my head. Everything would be so much simpler
And then your email gets compromised and everything is immediately lost? No thanks
Re: A well-known URL for changing passwords
#160Earlier quoted context omitted.
I wonder if URLs like /.well-known/login and /.well-known/logout would be a good idea, and should belong to a similar spec. Maybe even /.well-known/register, too.
Also .well-known/change-profile and .well-known/post-comment and .well-known/add-to-cart.
change-profile is usually a single URL that operates on the current user. Which resource would post-comment and add-to-cart act on?