A well-known URL for changing passwords

isostatic wrote: post #4

They say that iCloud Keychain on iOS 12 and Safari 12 have implemented this feature. And sure enough, https://www.icloud.com/.well-known/change-password Looking through the referenced RFC, there's a whole raft of "well known" urls that are registered https://www.iana.org/assignments/well-known-uris/well-known-... How widely adopted are these?

they are not well known

Re: A well-known URL for changing passwords

#6

Post by wolfgang42 » Thu, Dec 06, 2018, 2:56 PM UTC

Actual spec here: https://wicg.github.io/change-password-url/index.html

Re: A well-known URL for changing passwords

#7

Post by gregmac » Thu, Dec 06, 2018, 2:57 PM UTC

This is a nice simple convenience feature, for sure [1]:

> example.com provides a /.well-known/change-password resource which redirects to their change password form, wherever it happens to already be.

> Password managers check for the existence of /.well-known/change-password on https://example.com.

> If it's there (the response code is 2xx or 3xx), the password manager can cause the user's browser to navigate there when the user indicates they'd like to change their password.

It's not trying to enforce a particular password schema, it's not an API endpoint to automate changing passwords, and it is not trying to dictate site design or form layout.

It's also dirt simple to implement with practically zero cost.

Aside from Safari, it doesn't seem like any password managers have implemented this yet. It's also not in the IANA well-known URI registry [2] yet (even as draft), so that would probably at least allow it to get a bit more traction. Apparently they are working towards that [3].

[1] https://github.com/WICG/change-password-url/blob/gh-pages/ex...

[2] https://www.iana.org/assignments/well-known-uris/well-known-...

[3] https://twitter.com/rmondello/status/1042008520105779206

Re: A well-known URL for changing passwords

#8

Post by Someone1234 » Thu, Dec 06, 2018, 2:59 PM UTC

isostatic wrote: post #4

They say that iCloud Keychain on iOS 12 and Safari 12 have implemented this feature. And sure enough, https://www.icloud.com/.well-known/change-password Looking through the referenced RFC, there's a whole raft of "well known" urls that are registered https://www.iana.org/assignments/well-known-uris/well-known-... How widely adopted are these?

The one that Apple's browsers request on every domain isn't even in the list:

/.well-known/apple-app-site-association

That's the only .well-known request we have in our logs from the last year or more. Seems to be looking for an app associated with our site.

Aside from that, I don't know anyone or anything else using .well-known. Seems to be an Apple thing.

Re: A well-known URL for changing passwords

#9

Post by eponeponepon » Thu, Dec 06, 2018, 3:02 PM UTC

Someone1234 wrote: post #8

isostatic wrote: post #4

They say that iCloud Keychain on iOS 12 and Safari 12 have implemented this feature. And sure enough, https://www.icloud.com/.well-known/change-password Looking through the referenced RFC, there's a whole raft of "well known" urls that are registered https://www.iana.org/assignments/well-known-uris/well-known-... How widely adopted are these?

The one that Apple's browsers request on every domain isn't even in the list: /.well-known/apple-app-site-association That's the only .well-known request we have in our logs from the last year or more. Seems to be looking for an app associated with our site. Aside from that, I don't know anyone or anything else using .well-known. Seems to be an Apple thing.

I think LetsEncrypt uses it, no?

Re: A well-known URL for changing passwords

#10

Post by hannob » Thu, Dec 06, 2018, 3:03 PM UTC

That looks like a good idea, but why not go one step further? Provide a common API interface for password changes.

Think about it: If you assume your pw manager database is compromised - what do you do? Go to a hundred webpages and change your password? probably not. Your PW Manager can't provide a feature to do it for you. But it could if there was such an API.