3 ms·
I’d really love the W3C to come out with some elements that provide: 1) Communication of complexity requirements 2) Explicit password manager fill targets 3)
by teeray 5y ago
I’d really love the W3C to come out with some elements that provide:
1) Communication of complexity requirements
2) Explicit password manager fill targets
3) An endpoint for a password manager to rotate passwords automatically. (and the validity period)
All of these would be backwards compatible with grandmas that write passwords on post-its and mouldering IT policies that snub NIST recommendations. Sure, webauthn is wonderful and all, but it’s a whole lot easier to ask for some simple HTML changes rather than implementing a whole API.
- amelius 5y agoW3C can come up with all the elements they like but websites won't use them because they don't match with company style and the latest trends in graphic design.
- teeray 5y agoNone of these would be visible. They’d be glorified meta tags.
- whymarrh 5y agoThis is something that folks are working on via the `passwordrules` attribute https://github.com/whatwg/html/issues/3518 https://github.com/whatwg/html/issues/3518 With that and a well-known endpoint for changing passwords (not quite the same thing as what you’re describing; https://w3c.github.io/webappsec-change-password-url/ https://w3c.github.io/webappsec-change-password-url/) we are moving in that direction.