peterstory
commented
1 year ago Any thoughts on how to retrieve password rules for more than just the ~200 or so websites included in the 0000.pb shard? After reading the documentation, my understanding is that there are many shards, and that a shard containing password data for a particular domain can be identified based on the MD5 of that domain: https://chromium.googlesource.com/chromium/src/+/refs/heads/master/components/password_manager/core/browser/generation/password_requirements_spec_fetcher_unittest.cc#80
However, when I try to load other shards, I always get a 404. Here's an example, based on those unit tests:
curl \
-H "Origin: https://www.example.com" \
https://www.gstatic.com/chrome/autofill/password_generation_specs/1/5aba \
-o 5aba.pbPerhaps Google rate-limits access to this API, and an API key needs to be included?
m33x
Google's PasswordRequirementsSpec API:
In June 2018, Google started to develop a (in theory privacy protecting) password requirements specification API for Chrome's built-in password generator.
Essentially, the API returns something similar to the Password Rules (
password-rules.json) quirk from this project.As of February 2021, the API includes the password requirements for 237 websites (Feb. 2023: 246) (two example can be found at the end of this post).
The API returns the data as Protocol Buffers (protobuf).
Below you can find a step-by-step guide how to parse the response of the API with Python 3.
Step 1 - Create a Directory
Step 2 - Query the API
The API
URLcan be found here.We download all entries via:
Note: This part will change in the future. Once Google implements/activates their privacy protection, it is likely that this need to be revised. Read more here.
Step 3 - Download
protocCompilerWe download and install the binary
protocfrom GitHub.On macOS 13 Ventura it looks similar to this (you will need to adjust this to your OS):
Step 4 - Download
.protoSchema FilesWe download the
.protofiles which defines the protocol format of the0000.pbfile that we downloaded from the API in Step 2.Download
password_requirements.protoandpassword_requirements_shard.protoStep 5 - Compile Schema Files
Next, we compile the downloaded schema files so we can use them in Python 3.
Compile
password_requirements.prototopassword_requirements_pb2.pyandpassword_requirements_shard.prototopassword_requirements_shard_pb2.pyStep 6 - Prepare Python 3
We need to install
protobuffor Python 3.Step 7 - Parse the Response
Finally, we can parse the content via with a small script called
parse.pythat looks similar to this:You need to run it like this:
The now appearing entries look similar to this:
Step 8 - Convert PasswordRequirementsSpec to Password Rules Language (Missing)
Next, we will we need someone who is able to write a converter from Google's PasswordRequirementsSpec to Apple's Password Rules Language. Anyone?