3 ms·
Well, since password managers already tie a password to a specific domain, presumably they would use the same logic for determining the scope of the well-known
by CGamesPlay 8y ago
Well, since password managers already tie a password to a specific domain, presumably they would use the same logic for determining the scope of the well-known URL. I do agree that the spec could probably benefit from clarifying this, but I bet "the same domain as one of the recorded login URLs" is sufficient. (And the password manager would never even know to check evil.example.com if you hadn't ever put that password into that subdomain).
- Someone1234 8y ago> but I bet "the same domain as one of the recorded login URLs" is sufficient. What is that a quote from? I cannot find it in the spec here: https://wicg.github.io/change-password-url/index.html https://wicg.github.io/change-password-url/index.html
- CGamesPlay 8y agoSorry, intended as a hypothetical suggestion, not a quote.
- Someone1234 8y agoOh understood. Yeah that suggestion would fix my concerns almost wholesale. They just need to think about scoping it to e.g. domain, subdomain, etc.
- zeroimpl 8y agoChanging your password for a google account seems to involve going to myaccount.google.com (which is not the domain your login is associated with) - so clearly this needs to support redirects to different subdomains.