08:17 | <smaug> | Hmm, cssom-view spec broke? https://drafts.csswg.org/cssom-view/ |
08:18 | <smaug> | That gives only the directory listing |
08:18 | <smaug> | TabAtkins: ^ |
08:19 | <Andreu Botella> | drafts.csswg.org breaks sometimes |
08:19 | <Andreu Botella> | I have a mirror at https://andreubotella.com/csswg-auto-build/cssom-view |
17:51 | <raphaellouis> | Hi all! |
17:51 | <raphaellouis> | I have an interesting idea to make the web safer, I would like everyone's opinion! |
17:53 | <raphaellouis> | Here <input type="password" encrypted="rsa" required> |
17:53 | <raphaellouis> | What if we had a new attribute in the input field for passwords? |
17:54 | <raphaellouis> | An attribute to encrypt passwords? |
17:54 | <Andreu Botella> | Wouldn't you then have to have the RSA key in plain text in the page's code? |
18:04 | <raphaellouis> | @Hi!
- My idea is... that... so everything stays in localStorage - data stored here continues to exist even after being closed and reopened. This would not be saved in plaintext! ... Localstorage allows for example to manage some things in session...
- So good question.... I hope I helped answer this question or clarified something about it...
- Another option that I think of to solve this problem... if localstorage is something insecure, we can generate a qrcode... that way the user can have access to their encrypted passwords on each site without necessarily having saved something in the browser or without having necessarily use a program that generates things like rsa - reference: https://github.com/w3c/csswg-drafts/issues/6544 ... There is a discussion of creating an html element for qrcode
|
18:12 | <raphaellouis> |
- My idea is... that... so everything stays in localStorage - data stored here continues to exist even after being closed and reopened. This would not be saved in plaintext! ... Localstorage allows for example to manage some things in session...
- So good question.... I hope I helped answer this question or clarified something about it...
- Another option that I think of to solve this problem... if localstorage is something insecure, we can generate a qrcode... that way the user can have access to their encrypted passwords on each site without necessarily having saved something in the browser or without having necessarily use a program that generates things like rsa - reference: https://github.com/w3c/csswg-drafts/issues/6544 ... There is a discussion of creating an html element for qrcode
|
18:15 | <raphaellouis> | <object type="bfo/barcode">
<input type="password" encrypted="rsa" keypublic="public" keyprivate="private"/>
</object>
|
18:21 | <raphaellouis> |
- I deleted the message... because I didn't know it had a reply option. So, sorry
|
18:22 | <raphaellouis> |
- I read about it, here is my bibliographic references: https://www.tomsguide.com/news/dont-let-web-browsers-save-passwords, https://www.techrepublic.com/article/why-you-should-never-allow-your-web-browser-to-save-your-passwords/ , https://developer.mozilla.org/en-US/docs/Web/API/Web_Storage_API/Using_the_Web_Storage_API , https://www.techadvisor.com/feature/security/safe-store-passwords-in-browser-3813506/ , https://discourse.wicg.io/t/proposal-webcrypto-argon2-curve-448-25519-secp256k1-chacha20-poly1305/5132
|
18:39 | <raphaellouis> | I want you to criticize my argument with positive and negative points Argument:
- Many systems and internet sites are still old stuff, some of them don't use encryption... and even if they did, the user usually creates easy passwords...
- My objective in proposing the encrypted attribute would be to tell browsers that they manage the passwords of the users...
- I argue about this... because for you to be on the internet you usually have to have a browser... in part the passwords should be managed by the website providers, by the browsers and by the users... but the reality is different ...
- Usually users put easy passwords and generally some sites do not have encryption or security policy ...
- I think that this change in information security ... could be changed ... if browsers or the internet itself had a new attribute to html to make this possible
- Every change is something to think about... I just had this idea and I want to hear all sides
- This new attribute wouldn't be for plaintext... it should somehow be managed by localstorage if possible or maybe create a qrcode with that information
|
18:43 | <raphaellouis> | Note: Please don't think of this sentence as arrogance, my wish is to know if the argument is valid or not. more reference: https://www.w3.org/TR/WebCryptoAPI/ |
18:54 | <Domenic> | I think https://whatwg.org/faq#adding-new-features , especially step 1, is probably valuable here |
19:20 | <raphaellouis> | thank for feedback... looking at it now, i think this idea is bad. Thank you so much for everyone's attention |