4 ms·
> Maybe we can prevent password reuse by the browser taking a hash of the password being entered in a form and comparing it against other password hashes locall
by claudius 13y ago
> Maybe we can prevent password reuse by the browser taking a hash of the password being entered in a form and comparing it against other password hashes locally?
I always thought that one possible way around this would be for websites to generate the passwords for their users, essentially forcing them to use some sort of password storage (either in the browser, or LastPass, or whatever-you-want). So one would register with just an email address/username and then be shown a generated password à la O5O1zn8H3zEGNjf1Ly8v to store in the browser’s password manager.
Of course, this only works if people only ever use the service from devices they own and I have absolutely no idea how common internet café/public library users are nowadays.
- renata 13y agoAlso, plenty of bad services out there that restrict passwords in lots of different terrible ways.
- rz2k 13y agoIs that similar to using something like OpenID, where you sign into the authentication service, then one by one authorize the identity to log you into services? It seems like a more modular approach than using Facebook or Google to sign into third party sites, but similarly secure in terms of exposing passwords.
- claudius 13y agoI don’t think it has much to do with OpenID – my suggestion still keeps the classical username/password tuple as credentials, but simply disallows the user to choose the password freely. One extension, of course, would be for websites to somehow signal to browser ‘Hey, please store this password/username for this website’, but I’m not sure whether that's necessary.