2 ms·
It would be nice if there was a HTML standard for specifying password requirement data, like length ranges, valid/invalid characters, character type requirement
by oh_sigh 7y ago
It would be nice if there was a HTML standard for specifying password requirement data, like length ranges, valid/invalid characters, character type requirements(3 letters, 1 number, 1 special character), etc, so that password managers/generators could use it to always create a valid secure, valid password for you.
- webmaven 7y agoUseful idea, but I wouldn't it be exploitable by adversaries as well (eg. knowing those constraints would be helpful for generating dictionary attacks)?
- oh_sigh 7y agoIf you're targeting a specific site's database for a dictionary attack, finding out and entering the specific constraints would be minimal effort. And if you're not targeting a specific site, you probably want your dictionary to be as permissive as possible so can potentially match users on all sorts of sites.
- darknoon 7y agoNo, because attackers can easily determine the constraints (assuming they are kept "secret") by signing up for an account on their own.
- ClumsyPilot 7y agogood old security by obscurity
- edent 7y agoThere is. The `pattern` attribute lets you specify a regex for an input field - including password. https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/password#Validation https://developer.mozilla.org/en-US/docs/Web/HTML/Element/in...