5 ms·
This is a nice simple convenience feature, for sure [1]: > example.com provides a /.well-known/change-password resource which redirects to their change passwor
by gregmac 8y ago
This is a nice simple convenience feature, for sure [1]:
> example.com provides a /.well-known/change-password resource which redirects to their change password form, wherever it happens to already be.
> Password managers check for the existence of /.well-known/change-password on https://example.com https://example.com.
> If it's there (the response code is 2xx or 3xx), the password manager can cause the user's browser to navigate there when the user indicates they'd like to change their password.
It's not trying to enforce a particular password schema, it's not an API endpoint to automate changing passwords, and it is not trying to dictate site design or form layout.
It's also dirt simple to implement with practically zero cost.
Aside from Safari, it doesn't seem like any password managers have implemented this yet.
It's also not in the IANA well-known URI registry [2] yet (even as draft), so that would probably at least allow it to get a bit more traction. Apparently they are working towards that [3].
[1] https://github.com/WICG/change-password-url/blob/gh-pages/explainer.md#proposal https://github.com/WICG/change-password-url/blob/gh-pages/ex...
[2] https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml https://www.iana.org/assignments/well-known-uris/well-known-...
[3] https://twitter.com/rmondello/status/1042008520105779206 https://twitter.com/rmondello/status/1042008520105779206
- Immortalin 8y agoHere's an open source version of the common password rotation feature in most online password manager services: https://github.com/ddevault/pass-rotate https://github.com/ddevault/pass-rotate
- tomjakubowski 8y agooff topic but I'm dying to know: why is the "American Society of Heating, Refrigeration, and Air-conditioning Engineers (ASHRAE)" in the "People" section of that IANA well-known URI list?
- schoen 8y agoIt's apparently because of an HTTP-based home automation protocol: http://www.bacnet.org/ http://www.bacnet.org/ http://www.bacnet.org/Addenda/Add-135-2012am-ppr3-draft-17_chair_approved.pdf http://www.bacnet.org/Addenda/Add-135-2012am-ppr3-draft-17_c...
- hoppelhase 8y agoHow about something like: /.well-known/delete-account /.well-known/request-user-data This would also be nice as we wouldn't need things like https://justdelete.me https://justdelete.me
- dfabulich 8y agoI can't imagine those taking off without legislation. Making it easier to change passwords is more or less in the interest of the companies who make web sites; making it easier to delete accounts or export all of your data, by comparison, is not.
- hoppelhase 8y agoWell, yes. I was solely looking from a user's perspective.
- ygra 8y ago> making it easier to delete accounts or export all of your data, by comparison, is not. Isn't this mandated to be present and accessible by the GDPR anyway?
- landon32 8y agoYes but present and accessible is a low bar. For most companies you have to email support to make this happen.
- TeMPOraL 8y agoI can't imagine it either, but I wish we could try to establish things like these as having signalling value. Adding a redirect there is as trivial as it could possibly be, so if this could get established as "best practice", then there would be no excuse for companies not to support it. Ultimately, not having a clear and easy policy for cancelling the service and deleting the account only happens when the company is malicious, and attempts to exploit the user. Having this visible plain as day is something I'd love.
- 8y ago
- zamalek 8y agoThe one nice thing about specifying a password change API would be that password managers could change passwords automatically, but I can definitely see the elegance in not attaching it to this specific spec (it could be achieved with a meta tag or similar).