7

After I learned last week that the login data of some of my accounts was leaked, I had to change my passwords for more than 30 sites. That was tedious! As luck would have it, some days later we learned about Heartbleed. Oh great, now I’ll have to do all this again (and for even more sites now).

Then I read the question on SU: What's an efficient way to change my 200+ account passwords?

I wonder: Can there be a secure way to allow users to "automagically" change their passwords for different services? (assuming a "traditional" site that saves username and password, so no OpenID or alternatives)

Would it be a good idea for sites to offer some kind of API to change the password? If such an API would be standardized, users using a password manager could select all sites they want a new password for, and the password manager could set a new randomly created password for each of those sites.

Improve this question
4
  • 2
    Well at that point why not just switch to something like federated authentication or multifactor auth? That way password changes aren't actually required.
    – Steve
    Commented Apr 11, 2014 at 18:07
  • 4
    @SteveS because then you rely on a central authority that is a single point of failure in availability and can also impersonate you. And as for multifactor: well you're down to one factor if your password leaks. Perhaps the second protects you for a while, but it was two factor for a reason.
    – Luc
    Commented Apr 11, 2014 at 18:27
  • Would it be a good idea to ask 30 million web site owners to add a password changing API? Probably not. Would it be a good idea to provide a password changing API on your site? Maybe. Here's Microsoft's API, for reference: msdn.microsoft.com/en-us/library/dd305041.aspx
    – John Deters
    Commented Apr 11, 2014 at 21:41
  • @Luc fair point.
    – Steve
    Commented Apr 11, 2014 at 21:50

1 Answer 1

Reset to default
3

You've just about answered your question.

Can there be a secure way to allow users to "automagically" change their passwords for different services? Yes...

A standard open API to allow a user to change a web site password is possible and I say it's a decent idea.

Then again, a standard open API to allow a user to log in to a web site is possible and I say it's a good idea. But, amazingly, web site login process is becoming less, not more standardized; this basic function of a password manager is getting harder, not easier.

Security Considerations: Well, it makes it easier for a malicious user to cause a whole lot of trouble by changing many of a user's passwords at once. Resetting passwords will be as time consuming as ever. However, it's rare that malicious users change a great many of one user's passwords, even when they have the ability.

The password changer could have its own security flaws too, for example it could choose insufficiently random passwords, and implementations of the API could have security flaws.

On the other hand, it's relatively common for passwords to be compromised in ways that would be ameliorated by more frequent password changes.

So I'd say (with low certainly) that the downside is probably not greater than the upside.

I think a better idea would be to standardize and evangelize a free and open API based on the SRP (Secure Remote Password) protocol, or something like it. With SRP an eavesdropper or man in the middle cannot make many brute force guesses, so strong security can be obtained using relatively short/simple passwords. Furthermore the server does not store password-equivalent data. This means that an attacker who steals the server data cannot masquerade as the client. And if I'm not mistaken, it means that there is less of a problem when users use the same password with multiple web sites.

UPDATE: In the meantime, there's the LastPass Auto-Password Changing feature.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .