Hacker News Reader

Comment by matt_wulfeck | Hacker News Reader

I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. Or I can schedule them all to be updated every day, etc.

This drastically reduces the amount of valid logins from a dump that's even just a few days old.

2factor is simply not enough (though I still want it for important logins). Automatic password changing would be complimentary.

View on HN

>I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login.

There isn't really a need for a standardized API it would make things easier but if 1password wanted it's not a very hard thing to do without it.

All you need is to do an HTTP request to change the password most sites allow that to be done in a single request, CSRF might be an issue but non single action forms are usually not protected or there is no need for that and there are ways to bypass CSRF also.

For a company like 1password it wouldn't be hard to build a request profile for say Alexa 500/1000 and automatically change the passwords once a breach hits, I have a similar setup of several scripts that update the password for various services I have by generating a random password in Keepass getting the old password sending the password request post and updating the Keepass entry.

>I have a similar setup of several scripts that update the password for various services I have by generating a random password in Keepass getting the old password sending the password request post and updating the Keepass entry.

You would benefit from open-sourcing them, so others could help you keep up with websites changing.

LastPass scripted this [1] for their product.

[1] https://blog.lastpass.com/2014/12/introducing-auto-password-...

LastPass does this. I actually used it about a year ago to automatically change the passwords on about three dozen sites. It failed on two pages that had recently been updated. It's a very useful feature though.

Not made by the websites themselves but I think dashlane does something close to what you are asking for: https://www.dashlane.com/passwordchanger

Automatic password changing would be a mess if you ever got locked out of your password manager, combined with the fact that if the protocol for password changing was to be breached, you'd be locked out of that account as well.

The protocol isn't any different than it is today you need to know the account and the current password, there isn't anything more to breach then today it's no different than any password change form.

If you get locked out of your password manager you are already fucked.

And in any case It doesn't prevent users from reseting a password manually directly on each site.

You can export passwords from your password manager to a text file on a thumb drive, and store that in a safe, secret place. It's not perfect but works OK if you don't change passwords often.

Reply on news.ycombinator.com