Recipes that allow login credentials to be used across multiple domains (i .e ., realms)
Categories
(Toolkit :: Password Manager, enhancement, P3)
Tracking
()
People
(Reporter: ckarlof, Unassigned)
References
(Depends on 1 open bug, Blocks 4 open bugs, )
Details
(Whiteboard: [passwords:recipes])
User Story
Sites that could still benefit from this: * Country code TLDs (aka. ccTLDs): ADP, airBNB, Ancestry, eBay, Amazon, TicketMaster, Eventbrite, eHarmony, FourSquare, GlassDoor, Yelp, etc. * Microsoft: login.live.com, login.microsoftonline.com * Comcast/Xfinity: comcast.net, xfinity.com MIT Licensed list: https://github.com/apple/password-manager-resources/blob/master/quirks/websites-with-shared-credential-backends.json
Attachments
(3 obsolete files)
Some web sites span multiple origins, and the same login credentials can be used to authenticate oneself at all of the origins. I call this the "authentication realm" problem. It comes up in multiple contexts, including: * the realm allows login on http and https pages * the realm allows login from multiple subdomains * the realm allows login from completely different domains Currently, the password manager will store duplicate entries for each of the origins, which is not ideal, particularly if the credentials ever change. This is bug is to support recipes to indicate that a set of origins should be treated as "the same" by the password manager for indexing, capturing, and filling purposes.
Comment 1•10 years ago
|
||
Two things worry me: * An evil recipe could steal your passwords from a target site. Are these recipes written/reviewed/released as part of Firefox? * A recipe that equates origins with different security properties makes users less secure. Especially http vs https.
Updated•8 years ago
|
Comment 2•8 years ago
|
||
(In reply to Jesse Ruderman from comment #1) > Two things worry me: > * An evil recipe could steal your passwords from a target site. Are these > recipes written/reviewed/released as part of Firefox? > * A recipe that equates origins with different security properties makes > users less secure. Especially http vs https. I would assume that the user is responsible for umtimately grouping domains together. The Browser should do nothing but maybe give suggestions that need approval. We already use the credentials for the non-encrypted version of a website on the encrypted counterpart. Password changes are not synced back so new password won't be aautomatically submitted on the insecure part.
Updated•5 years ago
|
Comment 6•5 years ago
|
||
Safari has this concept already and stores their recipes in the DomainsWithAssociatedCredentials
key of WBSAutoFillQuirks.plist that ships with Safari.
This list will also be very useful for duplicate checking (bug 1118553) as a login probably shouldn't be considered a duplicate if the same credential is currently saved on two domains for the same "realm".
Updated•5 years ago
|
As a first step, is it crazy to grab the duplicate list from LastPass? It has a built in list that we could probably use, if the lawyers give it the OK.
It'd be nice for FF to have this list built in at the outset.
Comment 8•5 years ago
|
||
Getting a list of these sites from some external source is something we will consider.
For our future reference https://support.logmeininc.com/lastpass/help/duplicate-stored-passwords-across-multiple-sites-lp040007 talks about the default global list the LastPass has.
Comment 10•4 years ago
|
||
Mentioning this here from a related bug (Bug 1639737):
...it seems reasonable that if/when we implement realm support, we could provide a way for users to add their own realms if they would like to associate a login with multiple domains...
Updated•4 years ago
|
Comment 12•4 years ago
|
||
Apple has open-sourced their realm list under an MIT license! https://github.com/apple/password-manager-resources/blob/master/quirks/websites-with-shared-credential-backends.json
Updated•4 years ago
|
Comment 13•4 years ago
|
||
Updated•4 years ago
|
Updated•4 years ago
|
Comment 17•4 years ago
|
||
Same thing for:
https://en.wikipedia.org/
https://en.m.wikipedia.org/
https://de.wikipedia.org/
https://de.m.wikipedia.org/
https://eu.battle.net/login/en-us/
https://us.battle.net/login/en-us/
Comment 19•4 years ago
|
||
Updated•4 years ago
|
Comment 20•4 years ago
|
||
Comment on attachment 9199383 [details]
Bug 1120684 - Add websites-with-shared-credential-backends dump to tree. r=leplatrem
Revision D103105 was moved to bug 1687996. Setting attachment 9199383 [details] to obsolete.
Comment 21•4 years ago
|
||
Comment on attachment 9177498 [details]
Bug 1120684 - Allow autocomplete to use related realm credentials. r=sfoster!,leplatrem!,dimi
Revision D91205 was moved to bug 1699705. Setting attachment 9177498 [details] to obsolete.
Comment 23•4 years ago
|
||
Excuse me for the duplicate :(
I read all the bug and one thing maybe is not mentioned: will it be possible for the end user to add domains on his own configuration?
Updated•3 years ago
|
Updated•2 years ago
|
Updated•2 years ago
|
Description
•