4 ms·

This would break if the site owner changed their domain name, or more likely, they have multiple domains that redirect to the same IP address. Is that a serious

This would break if the site owner changed their domain name, or more likely, they have multiple domains that redirect to the same IP address. Is that a serious flaw?

tialaramex 6y ago
It's a problem certainly. To be fair that would also be a problem for many automated or semi-automated password managers. I have PassFF for example and it's currently suggesting the password it knows for news.ycombinator.com, I think it would guess that hacker-news.ycombinator.com should also suggest that, but if this site moved to https://hacker-news.example/ https://hacker-news.example/ I'd need to make the connection in my head to retrieve the password. One important thing compared to WebAuthn, which has this behaviour built into it, is that the site owner doesn't know you use PwdHash and so their testing won't discover this problem, indeed they might insist it isn't a problem at all because it isn't part of their mental model of password behaviour. Whereas in WebAuthn it just doesn't work, so even fairly light acceptance testing would discover that the new site can't re-use old WebAuthn credentials and that's a problem.