4 ms·

They say that iCloud Keychain on iOS 12 and Safari 12 have implemented this feature. And sure enough, https://www.icloud.com/.well-known/change-password https:

They say that iCloud Keychain on iOS 12 and Safari 12 have implemented this feature. And sure enough, https://www.icloud.com/.well-known/change-password https://www.icloud.com/.well-known/change-password Looking through the referenced RFC, there's a whole raft of "well known" urls that are registered https://www.iana.org/assignments/well-known-uris/well-known-uris.xml https://www.iana.org/assignments/well-known-uris/well-known-... How widely adopted are these?

codeulike 8y ago
they are not well known
Someone1234 8y ago
The one that Apple's browsers request on every domain isn't even in the list: /.well-known/apple-app-site-association That's the only .well-known request we have in our logs from the last year or more. Seems to be looking for an app associated with our site. Aside from that, I don't know anyone or anything else using .well-known. Seems to be an Apple thing.
- eponeponepon 8y ago
  I think LetsEncrypt uses it, no?
  - webignition 8y ago
    Yes, /.well-known/acme-challenge is used by LetsEncrypt.
  - toupeira 8y ago
    Yes, also OpenID Connect.
    - merb 8y ago
      sadly only for discovery. but it would be great if oauth/openid connect would actually use .well-known/authorize, etc. instead each provider has it's own sauce.
  - JeremyBanks 8y ago
    Yes, also Keybase.
- xena 8y ago
  Found documentation on it for you: https://developer.apple.com/library/archive/documentation/General/Conceptual/AppSearch/UniversalLinks.html https://developer.apple.com/library/archive/documentation/Ge...
  - Someone1234 8y ago
    The discussion was about specs/standards for .Well-Known. I pointed out that Apple's isn't in the list. In that context I don't follow why you think linking to Apple's development guide helps clarify anything? It still isn't a specified standard, and still isn't on the list of them.
    - geofft 8y ago
      You stated you were unsure what it was. The link clarifies that. And it is a specified standard: the link is the specification. It's not a standard developed by a multi-stakeholder standards organization, but there are other kinds of standards, too.
    - saagarjha 8y ago
      It really has no utility outside of Apple's app ecosystem, so why would you want it to become a standard?
- WorldMaker 8y ago
  WebFinger, a key underlying tech of the Fediverse and used for bootstrapping OpenID Connect, ActivityPub, and many other standards uses .well-known. https://webfinger.net/ https://webfinger.net/
ushi 8y ago
Thunderbird looks for http://domain.tld/.well-known/autoconfig/mail/config-v1.1.xml http://domain.tld/.well-known/autoconfig/mail/config-v1.1.xm... for autoconfiguration. See: https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration#Configuration_server_at_ISP https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird...
dandr01d 8y ago
Yes
tzs 8y ago
GnuPG can use /.well-known/openpgpkey since 2.1.12, and it is used by default since 2.1.23, when you do --lookup-key. E.g., $ gpg --lookup-key foo@example.org will include among the places searched /.well-known/openpgpkey/hu/<some-sort-of-hash-looking-thing>?l=foo at example.org It also looks at /.well-known/openpgpkey/policy. Toss in "-auto-key-locate=clear,wkd,nodefault" to force it to look there for the key even if it already has a key for that email address.
- Leace 8y ago
  <some-sort-of-hash-looking-thing> is ZBase32(SHA1(localPart)) and the standard is described here: https://wiki.gnupg.org/WKD https://wiki.gnupg.org/WKD If one controls a domain, has HTTPS set up and uses PGP this is the easiest and most secure way to host a key (`gpg --list-keys --with-wkd $KEY` shows the hash value). Enigmail, Mailpile, Mailvelope will automatically discover the key when composing an e-mail. ProtonMail is also working on integration of WKD with their web mail.
jtl999 8y ago
As a site owner, how many of those should you handle? Already do special handling of acme-challenge for Let's Encrypt/ACME but that's a given.
- tialaramex 8y ago
  As a site owner the main thing you should do about .well-known is be aware that it's special and so e.g. if you add a feature where users get a vanity page at www.example.com/username you shouldn't let them have the username .well-known The leading dot is there both because that is already special in POSIX and because there's a good chance your validation whitelisting already forbids leading dots, just like newlines, slashes and other characters we can expect to cause mayhem. So this was a less dangerous choice than just well-known without the dot.
mikeleung 8y ago
looks like the change was proposed by an apple WebKit developer: https://github.com/hober https://github.com/hober which would explain why apple has implemented it...
- hober 8y ago
  Yup, hi.
  - intern4tional 8y ago
    Regardless of what happens, thank you for trying to make the web a better place.
devman0 8y ago
Apparently https://github.com/.well-known/change-password https://github.com/.well-known/change-password also works.

codeulike 8y ago

they are not well known

Someone1234 8y ago

The one that Apple's browsers request on every domain isn't even in the list: /.well-known/apple-app-site-association That's the only .well-known request we have in our logs from the last year or more. Seems to be looking for an app associated with our site. Aside from that, I don't know anyone or anything else using .well-known. Seems to be an Apple thing.

eponeponepon 8y ago
I think LetsEncrypt uses it, no?
- webignition 8y ago
  Yes, /.well-known/acme-challenge is used by LetsEncrypt.
- toupeira 8y ago
  Yes, also OpenID Connect.
  - merb 8y ago
    sadly only for discovery. but it would be great if oauth/openid connect would actually use .well-known/authorize, etc. instead each provider has it's own sauce.
- JeremyBanks 8y ago
  Yes, also Keybase.
xena 8y ago
Found documentation on it for you: https://developer.apple.com/library/archive/documentation/General/Conceptual/AppSearch/UniversalLinks.html https://developer.apple.com/library/archive/documentation/Ge...
- Someone1234 8y ago
  The discussion was about specs/standards for .Well-Known. I pointed out that Apple's isn't in the list. In that context I don't follow why you think linking to Apple's development guide helps clarify anything? It still isn't a specified standard, and still isn't on the list of them.
  - geofft 8y ago
    You stated you were unsure what it was. The link clarifies that. And it is a specified standard: the link is the specification. It's not a standard developed by a multi-stakeholder standards organization, but there are other kinds of standards, too.
  - saagarjha 8y ago
    It really has no utility outside of Apple's app ecosystem, so why would you want it to become a standard?
WorldMaker 8y ago
WebFinger, a key underlying tech of the Fediverse and used for bootstrapping OpenID Connect, ActivityPub, and many other standards uses .well-known. https://webfinger.net/ https://webfinger.net/

ushi 8y ago

Thunderbird looks for http://domain.tld/.well-known/autoconfig/mail/config-v1.1.xml http://domain.tld/.well-known/autoconfig/mail/config-v1.1.xm... for autoconfiguration. See: https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration#Configuration_server_at_ISP https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird...

dandr01d 8y ago

Yes

tzs 8y ago

GnuPG can use /.well-known/openpgpkey since 2.1.12, and it is used by default since 2.1.23, when you do --lookup-key. E.g., $ gpg --lookup-key foo@example.org will include among the places searched /.well-known/openpgpkey/hu/<some-sort-of-hash-looking-thing>?l=foo at example.org It also looks at /.well-known/openpgpkey/policy. Toss in "-auto-key-locate=clear,wkd,nodefault" to force it to look there for the key even if it already has a key for that email address.

Leace 8y ago
<some-sort-of-hash-looking-thing> is ZBase32(SHA1(localPart)) and the standard is described here: https://wiki.gnupg.org/WKD https://wiki.gnupg.org/WKD If one controls a domain, has HTTPS set up and uses PGP this is the easiest and most secure way to host a key (`gpg --list-keys --with-wkd $KEY` shows the hash value). Enigmail, Mailpile, Mailvelope will automatically discover the key when composing an e-mail. ProtonMail is also working on integration of WKD with their web mail.

jtl999 8y ago

As a site owner, how many of those should you handle? Already do special handling of acme-challenge for Let's Encrypt/ACME but that's a given.

tialaramex 8y ago
As a site owner the main thing you should do about .well-known is be aware that it's special and so e.g. if you add a feature where users get a vanity page at www.example.com/username you shouldn't let them have the username .well-known The leading dot is there both because that is already special in POSIX and because there's a good chance your validation whitelisting already forbids leading dots, just like newlines, slashes and other characters we can expect to cause mayhem. So this was a less dangerous choice than just well-known without the dot.

mikeleung 8y ago

looks like the change was proposed by an apple WebKit developer: https://github.com/hober https://github.com/hober which would explain why apple has implemented it...

hober 8y ago
Yup, hi.
- intern4tional 8y ago
  Regardless of what happens, thank you for trying to make the web a better place.

devman0 8y ago

Apparently https://github.com/.well-known/change-password https://github.com/.well-known/change-password also works.