9 ms·
We should introduce an industry best practice for account management. A "/.well-known" url for changing passwords would make this trivial to do in bulk with a p
by fckthisguy 4y ago
We should introduce an industry best practice for account management. A "/.well-known" url for changing passwords would make this trivial to do in bulk with a password manager.
- monsieurbanana 4y agoNothing could go wrong with having a way of hitting millions of websites at once with a 0 day exploit :)
- dns_snek 4y agoThe functionality provided by such an API could be limited to disabling the account until the password is manually reset given that the client provides a valid email and password. The blast radius for that would be pretty small. I don't use 90% of the entries in my password manager on a monthly basis so anything that allows me to delay the password change on hundreds of accounts until I need to use the account again would be valuable.
- devnullbrain 4y agoObscurity is security, as the saying goes.
- lathiat 4y agohttps://www.w3.org/TR/change-password-url/ https://www.w3.org/TR/change-password-url/
- 2Gkashmiri 4y agoso if i get access to your PM, then i would be able to destroy all your accounts en masse. at least this way they would have to prioritize
- alpaca128 4y agoI don't think this matters that much. Most accounts are just for random websites that don't let you use basic functionality without a login. Being able to manage such accounts efficiently & without dark patterns in one program would be a massive time-saver, but whether a bad actor takes a few seconds or a few minutes to take over my important accounts I'm screwed either way.