6 ms·

I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automat

I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. Or I can schedule them all to be updated every day, etc. This drastically reduces the amount of valid logins from a dump that's even just a few days old. 2factor is simply not enough (though I still want it for important logins). Automatic password changing would be complimentary.

dogma1138 10y ago
>I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. There isn't really a need for a standardized API it would make things easier but if 1password wanted it's not a very hard thing to do without it. All you need is to do an HTTP request to change the password most sites allow that to be done in a single request, CSRF might be an issue but non single action forms are usually not protected or there is no need for that and there are ways to bypass CSRF also. For a company like 1password it wouldn't be hard to build a request profile for say Alexa 500/1000 and automatically change the passwords once a breach hits, I have a similar setup of several scripts that update the password for various services I have by generating a random password in Keepass getting the old password sending the password request post and updating the Keepass entry.
- allendoerfer 10y ago
  >I have a similar setup of several scripts that update the password for various services I have by generating a random password in Keepass getting the old password sending the password request post and updating the Keepass entry. You would benefit from open-sourcing them, so others could help you keep up with websites changing.
- niftich 10y ago
  LastPass scripted this [1] for their product. [1] https://blog.lastpass.com/2014/12/introducing-auto-password-changing-with.html/ https://blog.lastpass.com/2014/12/introducing-auto-password-...
- datguacdoh 10y ago
  LastPass does this. I actually used it about a year ago to automatically change the passwords on about three dozen sites. It failed on two pages that had recently been updated. It's a very useful feature though.
whorleater 10y ago
Automatic password changing would be a mess if you ever got locked out of your password manager, combined with the fact that if the protocol for password changing was to be breached, you'd be locked out of that account as well.
- dogma1138 10y ago
  The protocol isn't any different than it is today you need to know the account and the current password, there isn't anything more to breach then today it's no different than any password change form. If you get locked out of your password manager you are already fucked. And in any case It doesn't prevent users from reseting a password manually directly on each site.
  - cuu508 10y ago
    You can export passwords from your password manager to a text file on a thumb drive, and store that in a safe, secret place. It's not perfect but works OK if you don't change passwords often.
deleted 10y ago
[deleted]
ntlve 10y ago
Not made by the websites themselves but I think dashlane does something close to what you are asking for: https://www.dashlane.com/passwordchanger https://www.dashlane.com/passwordchanger

dogma1138 10y ago

>I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. There isn't really a need for a standardized API it would make things easier but if 1password wanted it's not a very hard thing to do without it. All you need is to do an HTTP request to change the password most sites allow that to be done in a single request, CSRF might be an issue but non single action forms are usually not protected or there is no need for that and there are ways to bypass CSRF also. For a company like 1password it wouldn't be hard to build a request profile for say Alexa 500/1000 and automatically change the passwords once a breach hits, I have a similar setup of several scripts that update the password for various services I have by generating a random password in Keepass getting the old password sending the password request post and updating the Keepass entry.

allendoerfer 10y ago
>I have a similar setup of several scripts that update the password for various services I have by generating a random password in Keepass getting the old password sending the password request post and updating the Keepass entry. You would benefit from open-sourcing them, so others could help you keep up with websites changing.
niftich 10y ago
LastPass scripted this [1] for their product. [1] https://blog.lastpass.com/2014/12/introducing-auto-password-changing-with.html/ https://blog.lastpass.com/2014/12/introducing-auto-password-...
datguacdoh 10y ago
LastPass does this. I actually used it about a year ago to automatically change the passwords on about three dozen sites. It failed on two pages that had recently been updated. It's a very useful feature though.

whorleater 10y ago

Automatic password changing would be a mess if you ever got locked out of your password manager, combined with the fact that if the protocol for password changing was to be breached, you'd be locked out of that account as well.

dogma1138 10y ago
The protocol isn't any different than it is today you need to know the account and the current password, there isn't anything more to breach then today it's no different than any password change form. If you get locked out of your password manager you are already fucked. And in any case It doesn't prevent users from reseting a password manually directly on each site.
- cuu508 10y ago
  You can export passwords from your password manager to a text file on a thumb drive, and store that in a safe, secret place. It's not perfect but works OK if you don't change passwords often.

deleted 10y ago

[deleted]

ntlve 10y ago

Not made by the websites themselves but I think dashlane does something close to what you are asking for: https://www.dashlane.com/passwordchanger https://www.dashlane.com/passwordchanger