3 ms·

Could web developers and password manager developers get together and develop a standard web API for authenticating with a website? I want to specify a URL and

by jes 8y ago

Could web developers and password manager developers get together and develop a standard web API for authenticating with a website? I want to specify a URL and have my password manager run a behind-the-scenes conversation with the website and, ultimately, drop me into the home page in a logged-in state.

amaccuish 8y ago
> Could web developers and password manager developers get together and develop a standard web API for authenticating with a website? There is, it's called HTTP basic. But I guess you're meaning more form based login? Well most password boxes are fairly obvious from an HTML point of view already.
koolba 8y ago
Ditto for a standard API for updates. That way you could have your password manager automatically rotate your password, either on a schedule or in response to a known breach. Hell we should have an API or machine readable stream for breaches too.
- jes 8y ago
  Fully agree.
- Ajedi32 8y ago
  At that point, you might as well just move to full public-key based authentication. https://www.w3.org/TR/webauthn/ https://www.w3.org/TR/webauthn/
sinistersnare 8y ago
There was this HN post a bit ago: Relevant Link: https://wicg.github.io/change-password-url/index.html https://wicg.github.io/change-password-url/index.html HN comments: https://news.ycombinator.com/item?id=18618193 https://news.ycombinator.com/item?id=18618193
- jes 8y ago
  Thank you for these references.
Ajedi32 8y ago
Already exists: https://www.w3.org/TR/credential-management-1/ https://www.w3.org/TR/credential-management-1/ All we really need is a few password managers to implement support for it (I think Chrome's built-in password manager already does), then sites can start using it to progressively enhance their login process.
IggleSniggle 8y ago
The SQRL protocol "fixes" all of these password issues, by effectively cutting out the middleman of a password manager. Ie, it gives you everything that a user/pass + password-manager setup does, identity and security-wise, without the need for any forms beyond whatever you might want for eg registering a username with a new site. https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm

by jes 8y ago

amaccuish 8y ago

> Could web developers and password manager developers get together and develop a standard web API for authenticating with a website? There is, it's called HTTP basic. But I guess you're meaning more form based login? Well most password boxes are fairly obvious from an HTML point of view already.

koolba 8y ago

Ditto for a standard API for updates. That way you could have your password manager automatically rotate your password, either on a schedule or in response to a known breach. Hell we should have an API or machine readable stream for breaches too.

jes 8y ago
Fully agree.
Ajedi32 8y ago
At that point, you might as well just move to full public-key based authentication. https://www.w3.org/TR/webauthn/ https://www.w3.org/TR/webauthn/

sinistersnare 8y ago

There was this HN post a bit ago: Relevant Link: https://wicg.github.io/change-password-url/index.html https://wicg.github.io/change-password-url/index.html HN comments: https://news.ycombinator.com/item?id=18618193 https://news.ycombinator.com/item?id=18618193

jes 8y ago
Thank you for these references.

Ajedi32 8y ago

Already exists: https://www.w3.org/TR/credential-management-1/ https://www.w3.org/TR/credential-management-1/ All we really need is a few password managers to implement support for it (I think Chrome's built-in password manager already does), then sites can start using it to progressively enhance their login process.

IggleSniggle 8y ago

The SQRL protocol "fixes" all of these password issues, by effectively cutting out the middleman of a password manager. Ie, it gives you everything that a user/pass + password-manager setup does, identity and security-wise, without the need for any forms beyond whatever you might want for eg registering a username with a new site. https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm