[ ] Information has been included about the website's requirements (eg. screenshots, error messages, steps during experimentation, etc.)
[ ] The PR isn't documenting something that would be a common practice among password managers (e.g. minimal length of 6)
for change-password-URLs.json
[ ] There is no Well-Known URL for Changing Passwords (https://example.com/.well-known/change-password)
[ ] The URL either makes the experience better or no worse than being directed to just the domain in a non-logged-in state
for shared-credentials.json
[ ] There's evidence the domains are currently related (SSL certificates, DNS entries, valid links between sites, legal documents etc.)
[ ] If using shared, the new group serves login pages on each of the included domains, and those login pages accept accounts from the others. (For example, we wouldn't use a shared association from google.co.il to google.com, because google.co.il redirects to accounts.google.com for sign in.)
[ ] If using from and to, the new group, the from domain(s) redirect to the to domain to log in.
for shared-credentials-historical.json
[ ] You believe that the domains were associated at some point in the past and can explain that relationship
Flickr no longer shares a credential backend with Yahoo.
Supporting resources:
Overall Checklist
for password-rules.json
for change-password-URLs.json
https://example.com/.well-known/change-password
)for shared-credentials.json
shared
, the new group serves login pages on each of the included domains, and those login pages accept accounts from the others. (For example, we wouldn't use ashared
association fromgoogle.co.il
togoogle.com
, becausegoogle.co.il
redirects toaccounts.google.com
for sign in.)from
andto
, the new group, thefrom
domain(s) redirect to theto
domain to log in.for shared-credentials-historical.json