Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 May 2016 06:12:22 -0800
From: Royce Williams <royce@...hsolvency.com>
To: passwords@...ts.openwall.com
Subject: Re: Password-Manager Friendly (PMF) semantic markup

On Mon, May 9, 2016 at 11:59 PM, Per Thorsheim <per@...rsheim.net> wrote:
>
> http://pmfriendly.org/
>
> First presented by Max Spencer at #passwords14 in Trondheim, I am still
> a fan of this idea.
>
> Basically implementing some stuff into HTML that tells any password
> manager what minimum/maximum/restrictions etc a site has for passwords,
> allowing a password manager to automatically generate the best possible
> password without any additional user interaction or error handling.
>
> "All we need" is:
> - A standard
> - Get major browsers to support the standard
> - Get major password managers to support it
> - Make OWASP adopt it
> - Have all websites in the world (preferably) adopt it for the greater good
>
> Easy. No where do we begin?

Great idea!

A brief survey of prior public discussion yields little, other than
people saying "yeah, this would be good" posts like this:

https://discussions.agilebits.com/discussion/58010/microformat-for-defining-password-rules

I suggest extending the scope to include non-HTML apps as well,
perhaps by providing an XML format, such as:

http://searchwindevelopment.techtarget.com/tip/Best-Practice-Enforcing-password-complexity

We might include not just password complexity rules, but other
qualities of authentication, including:

- Password aging policy
- Supported 2FA/MFA methods
- Supported types of federation (log in with Google, Facebook, etc.)
- Hashing method and parameters (salt, rounds, etc.) -- a signal of
(in)competence ;)
- SAML awareness? (not sure what's possible/useful here)

I'd bet that Tantek Celik would be interested in helping making it
microformat-friendly.

Getting big sites could build momentum. Wordpress,
Google/Blogger/Blogspot, Yahoo, Hotmail etc. come to mind. Wordpress
uses phpass, so they might be the most open-minded.

Royce

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.