The “security.txt” proposal reached last step in the IETF process

Re:The “security.txt” proposal reached last step in the IETF... by Someone1234 on Wednesday December 11, 2019 @04:37PM (#21767042)

If you had a machine readable definition for what is allowed within a password, wouldn't it make more sense to put that close to the password entry itself (e.g. on the input element/page)?

Having a site-wide definition seems like it would require a lot of mechanics to target specifc pages or properties that may have different rules (e.g. consumer Vs. corporate logins).

I still hope companies start following NIST guidelines and stop having password rules entirely.

[ Parent | on HN ]

Re:The “security.txt” proposal reached last step in the IETF... by lilyball on Wednesday December 11, 2019 @05:30PM (#21767478)

The input tag already has a 'pattern' attribute that is a regex that the input must match to be valid.

[ Parent | on HN ]

Re:The “security.txt” proposal reached last step in the IETF... by mjevans on Wednesday December 11, 2019 @04:40PM (#21767068)

I like the idea of a tiered approach so that this could be bolted on to legacy systems where necessary.

Website wide obviously being over-ruled by local over-rides.

[ Parent | on HN ]