08:17
<smaug>
Hmm, cssom-view spec broke? https://drafts.csswg.org/cssom-view/
08:18
<smaug>
That gives only the directory listing
08:18
<smaug>
TabAtkins: ^
08:19
<Andreu Botella>
drafts.csswg.org breaks sometimes
08:19
<Andreu Botella>
I have a mirror at https://andreubotella.com/csswg-auto-build/cssom-view
17:51
<raphaellouis>
Hi all!
17:51
<raphaellouis>
I have an interesting idea to make the web safer, I would like everyone's opinion!
17:53
<raphaellouis>
Here <input type="password" encrypted="rsa" required>
17:53
<raphaellouis>
What if we had a new attribute in the input field for passwords?
17:54
<raphaellouis>
An attribute to encrypt passwords?
17:54
<Andreu Botella>
Wouldn't you then have to have the RSA key in plain text in the page's code?
18:04
<raphaellouis>

@Hi!

  1. My idea is... that... so everything stays in localStorage - data stored here continues to exist even after being closed and reopened. This would not be saved in plaintext! ... Localstorage allows for example to manage some things in session...
  2. So good question.... I hope I helped answer this question or clarified something about it...
  3. Another option that I think of to solve this problem... if localstorage is something insecure, we can generate a qrcode... that way the user can have access to their encrypted passwords on each site without necessarily having saved something in the browser or without having necessarily use a program that generates things like rsa - reference: https://github.com/w3c/csswg-drafts/issues/6544 ... There is a discussion of creating an html element for qrcode
18:12
<raphaellouis>
  1. My idea is... that... so everything stays in localStorage - data stored here continues to exist even after being closed and reopened. This would not be saved in plaintext! ... Localstorage allows for example to manage some things in session...
  2. So good question.... I hope I helped answer this question or clarified something about it...
  3. Another option that I think of to solve this problem... if localstorage is something insecure, we can generate a qrcode... that way the user can have access to their encrypted passwords on each site without necessarily having saved something in the browser or without having necessarily use a program that generates things like rsa - reference: https://github.com/w3c/csswg-drafts/issues/6544 ... There is a discussion of creating an html element for qrcode
18:15
<raphaellouis>
<object type="bfo/barcode">
 <input type="password" encrypted="rsa" keypublic="public" keyprivate="private"/>
</object>
18:21
<raphaellouis>
  1. I deleted the message... because I didn't know it had a reply option. So, sorry
18:22
<raphaellouis>
  1. I read about it, here is my bibliographic references: https://www.tomsguide.com/news/dont-let-web-browsers-save-passwords, https://www.techrepublic.com/article/why-you-should-never-allow-your-web-browser-to-save-your-passwords/ , https://developer.mozilla.org/en-US/docs/Web/API/Web_Storage_API/Using_the_Web_Storage_API , https://www.techadvisor.com/feature/security/safe-store-passwords-in-browser-3813506/ , https://discourse.wicg.io/t/proposal-webcrypto-argon2-curve-448-25519-secp256k1-chacha20-poly1305/5132
18:39
<raphaellouis>

I want you to criticize my argument with positive and negative points
Argument:

  1. Many systems and internet sites are still old stuff, some of them don't use encryption... and even if they did, the user usually creates easy passwords...
  2. My objective in proposing the encrypted attribute would be to tell browsers that they manage the passwords of the users...
  3. I argue about this... because for you to be on the internet you usually have to have a browser... in part the passwords should be managed by the website providers, by the browsers and by the users... but the reality is different ...
  4. Usually users put easy passwords and generally some sites do not have encryption or security policy ...
  5. I think that this change in information security ... could be changed ... if browsers or the internet itself had a new attribute to html to make this possible
  6. Every change is something to think about... I just had this idea and I want to hear all sides
  7. This new attribute wouldn't be for plaintext... it should somehow be managed by localstorage if possible or maybe create a qrcode with that information
18:43
<raphaellouis>
Note: Please don't think of this sentence as arrogance, my wish is to know if the argument is valid or not. more reference: https://www.w3.org/TR/WebCryptoAPI/
18:54
<Domenic>
I think https://whatwg.org/faq#adding-new-features , especially step 1, is probably valuable here
19:20
<raphaellouis>
thank for feedback... looking at it now, i think this idea is bad. Thank you so much for everyone's attention