<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>As its a hash of your master password, it's safe to increment your master password by one as an exception. <br><br><span style="background-color: rgba(255, 255, 255, 0);">Ryan Feeley – terse mobile edition<br>Product Designer, Identity<br>Mozilla UX<br>IRC: rfeeley</span></div><div><br>On Oct 3, 2014, at 7:49 PM, Chris Karlof <<a href="mailto:ckarlof@mozilla.com">ckarlof@mozilla.com</a>> wrote:<br><br></div><blockquote type="cite"><div><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><br><div><div>On Oct 3, 2014, at 7:22 AM, Ryan Feeley <<a href="mailto:rfeeley@mozilla.com">rfeeley@mozilla.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">I showed the password playground to a friend (and xoogler) yesterday who was strongly opposed to us deploying this on anything but one site (e.g. we should not make this available for other sites to use as a service on the web). If sites starting linking to the playground from their password manager, we would indirectly be encouraging password reuse. He felt that people would just start using the playground like a password generator entering the same phrase everywhere.<div><br></div><div>He suggests that instead of a 1Password-style password manager, we should instead be exploring a password generator not unlike:</div><div><span class="Apple-tab-span" style="white-space:pre"> </span><span class="author-p-10747 url"><a href="https://oneshallpass.com/">https://oneshallpass.com/</a></span></div><div><div><span class="Apple-tab-span" style="white-space:pre"> </span>or</div><div><span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://www.supergenpass.com/mobile/">http://www.supergenpass.com/mobile/</a></div><div>…which combines a phrase with the hostname and generates a strong password, but doesn’t actually store passwords.</div><div><br></div><div>There are a upsides and downsides to this approach as it’s so radically different, but I’m going to explore the idea of native support in the browser, likely in some kind of Australis-menu item.<br><div><br></div></div></div></div></blockquote><div><br></div><div>I agree you’d want to salt the passwords in some way. Doing based on the domain has been proposed before, but it’s challenging. What if you want to change the password for a single site?</div><div><br></div><div>-chris</div><div><br></div><div><br></div><div><br></div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div><div><div><div><div apple-content-edited="true">
<div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div style="font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Ryan Feeley</div><div>UX, Cloud Services</div><div>Mozilla UX</div><div>IRC: rfeeley</div></div></div></div></div></div>
</div>
<br><div><div>On Oct 2, 2014, at 12:24 PM, Jared Hirsch <<a href="mailto:6a68@mozilla.com">6a68@mozilla.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br>On Oct 2, 2014, at 8:28 AM, jgruen <<a href="mailto:jgruen@mozilla.com">jgruen@mozilla.com</a>> wrote:<br><br><blockquote type="cite">Here’s the prototype I built for intern Greg this summer:<a href="http://people.mozilla.org/~jgruen/passwords/mnemonic/#mn-two">http://people.mozilla.org/~jgruen/passwords/mnemonic/#mn-two</a><br><br>Ryan, your mockup shows color changing letters in a <textarea>, whereas my prototype uses a second <div> to highlight first chars of each substring. Off the top of my head, IDK how to implement the color change directly in a <textarea>. I’m sure there’s a hack out there somewhere, but I’m open to suggestions.<br></blockquote><br>Here's an idea: instead of a textarea, you could use a sized div with a solid border and contenteditable set to "true".<br><br>You could drop in some jQuery if you need it to be draggable-resizable.<br><br>Have fun :-)<br><br>Jared<br><br><br><blockquote type="cite"><br>JG<br><br><br>On Oct 1, 2014, at 6:19 PM, Chris Karlof <<a href="mailto:ckarlof@mozilla.com">ckarlof@mozilla.com</a>> wrote:<br><br><blockquote type="cite">Nick and Shane, also.<br><br>I’m thinking something very quick and dirty here. Maybe something we can enable/disable with a feature toggle, or only show to a small number of users to start.<br><br>-chris<br><br><br><br>On Oct 1, 2014, at 3:11 PM, Ryan Feeley <<a href="mailto:rfeeley@mozilla.com">rfeeley@mozilla.com</a>> wrote:<br><br><blockquote type="cite">Hi all,<br><br>I had a chat with Chris Karlof today about a tool to help users create better passwords. Based on some early work I did, and further development by Greg Norcie and John Gruen, I’m hoping we can create a little wizard to do just that.<br><br>I created an issue which includes a link to the wireframes:<br><span class="Apple-tab-span" style="white-space: pre;"> </span><a href="https://github.com/mozilla/fxa-content-server/issues/1732">https://github.com/mozilla/fxa-content-server/issues/1732</a><br><br>This is something we can deploy for FxA but also eventually offer to other sites on the web as a service (they can link or use an iframe overlay).<br><br>Zaach and Vlad, is this something that’s possible for the next two weeks?<br><br>Katie, we’d also like to track impressions and click-thrus. How many people take advantage of a tool that helps them make a better password when it’s available? (you might see where we’re doing with this).<br><br>Take a look, and feedback appreciated (keep in mind I’d love to keep it down to one screen though).<br><br>Ryan Feeley<br>UX, Cloud Services<br>Mozilla UX<br>IRC: rfeeley<br><br>_______________________________________________<br>Dev-fxacct mailing list<br><a href="mailto:Dev-fxacct@mozilla.org">Dev-fxacct@mozilla.org</a><br><a href="https://mail.mozilla.org/listinfo/dev-fxacct">https://mail.mozilla.org/listinfo/dev-fxacct</a><br></blockquote><br>_______________________________________________<br>Dev-fxacct mailing list<br><a href="mailto:Dev-fxacct@mozilla.org">Dev-fxacct@mozilla.org</a><br><a href="https://mail.mozilla.org/listinfo/dev-fxacct">https://mail.mozilla.org/listinfo/dev-fxacct</a><br></blockquote><br>_______________________________________________<br>Dev-fxacct mailing list<br><a href="mailto:Dev-fxacct@mozilla.org">Dev-fxacct@mozilla.org</a><br><a href="https://mail.mozilla.org/listinfo/dev-fxacct">https://mail.mozilla.org/listinfo/dev-fxacct</a></blockquote></div></blockquote></div><br></div></div></div></div></div>_______________________________________________<br>Dev-fxacct mailing list<br><a href="mailto:Dev-fxacct@mozilla.org">Dev-fxacct@mozilla.org</a><br><a href="https://mail.mozilla.org/listinfo/dev-fxacct">https://mail.mozilla.org/listinfo/dev-fxacct</a><br></blockquote></div><br></div></blockquote></body></html>