[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+E3k90UQ1T3AqROw_pTKyJaGXeedwDnfc=XNVYChVWobySu-w@mail.gmail.com>
Date: Tue, 10 May 2016 06:12:22 -0800
From: Royce Williams <royce@...hsolvency.com>
To: passwords@...ts.openwall.com
Subject: Re: Password-Manager Friendly (PMF) semantic markup
On Mon, May 9, 2016 at 11:59 PM, Per Thorsheim <per@...rsheim.net> wrote:
>
> http://pmfriendly.org/
>
> First presented by Max Spencer at #passwords14 in Trondheim, I am still
> a fan of this idea.
>
> Basically implementing some stuff into HTML that tells any password
> manager what minimum/maximum/restrictions etc a site has for passwords,
> allowing a password manager to automatically generate the best possible
> password without any additional user interaction or error handling.
>
> "All we need" is:
> - A standard
> - Get major browsers to support the standard
> - Get major password managers to support it
> - Make OWASP adopt it
> - Have all websites in the world (preferably) adopt it for the greater good
>
> Easy. No where do we begin?
Great idea!
A brief survey of prior public discussion yields little, other than
people saying "yeah, this would be good" posts like this:
https://discussions.agilebits.com/discussion/58010/microformat-for-defining-password-rules
I suggest extending the scope to include non-HTML apps as well,
perhaps by providing an XML format, such as:
http://searchwindevelopment.techtarget.com/tip/Best-Practice-Enforcing-password-complexity
We might include not just password complexity rules, but other
qualities of authentication, including:
- Password aging policy
- Supported 2FA/MFA methods
- Supported types of federation (log in with Google, Facebook, etc.)
- Hashing method and parameters (salt, rounds, etc.) -- a signal of
(in)competence ;)
- SAML awareness? (not sure what's possible/useful here)
I'd bet that Tantek Celik would be interested in helping making it
microformat-friendly.
Getting big sites could build momentum. Wordpress,
Google/Blogger/Blogspot, Yahoo, Hotmail etc. come to mind. Wordpress
uses phpass, so they might be the most open-minded.
Royce
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
