[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+E3k91B3-PVaxRe9TEa6t8i8=cbr5esC+wNBbfXc55Pw7vRzg@mail.gmail.com>
Date: Tue, 10 May 2016 09:35:47 -0800
From: Royce Williams <royce@...hsolvency.com>
To: passwords@...ts.openwall.com
Subject: Re: Password-Manager Friendly (PMF) semantic markup
On Tue, May 10, 2016 at 9:26 AM, Matt Weir <cweir@...edu> wrote:
> I hate how skeptical this sounds but ... what does everyone think the
> likelihood of the values represented in this field represent the password
> policy that is currently in place?
>
> Many of the disclosed databases I've seen are a true mishmash of different
> password policies and underlying technologies used over time. What
> mechanisms do you think could be implimented so that this data field matches
> up with the true requirements, and how should password managers fail
> gracefully when these fields are incorrect?
>
> My concern is that such a mechanism could cause more user frustration than
> it solves due to website owners not keeping their info up to date, and that
> frustration would be (incorrectly) focused on the password management
> programs themselves.
It's a fair point, Matt.
Wearing my optimist hat, perhaps as the standard matures and spreads,
password managers would need to treat the values as signal, but not as
confirmed truth.
In other words, your valid concerns could be incorporated as a constraint.
Royce
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
