search

aviv-world / aim

AVIV Identity Manager
0 stars 2 forks source link

Need to be smarter about subdomains #2

Open saragarmee opened 6 years ago

saragarmee commented 6 years ago

At present, the hostname of the site is used. This may or may not include a specific subdomain. e.g.

login.somedomain.com
register.somedomain.com

Whereas the site itself may be sitting on www.somedomain.com

Currently passwords are specific to the hostname, and if you aren't on the specific hostname when attempting to login, then you won't see the option to copy your password.

This may require implementing a regex search for existing domains, or walking the localstorage tree looking for anything where the domain matches at the TLD level.

Wanted to open this up because even though this is intended for aviv.world where each mint will have it's own subdomain, that is not usually the case. Yet there are instances such as zimbra where for example the admin login is completely unrelated to the user login.

Let's discuss.

oberondelafay commented 6 years ago

I agree that this is an issue and we should make fixing this a priority. As a temporary work around, the domain name (but not the password), is stored in plaintext in localstorage in the browser.

You can go to 

chrome://extensions

Click on "background.html", then go to application click on localstorage, find the subdomain and change it to whatever the website is expecting. Clearly intended as a permanent fix, but it will at least get you into sites that use a different subdomain for registration than for logging in.

oberondelafay commented 6 years ago

It may be better to allow people to select the specific domain they are trying to select a password for, this way a casual subdomain isn't missed, but we also avoid conflicts where there is a genuine difference between the account as sub1.domain.com vs sub2.domain.com

We do want to be careful to avoid password re-use in instances where it isn't warranted. A good example would be githubpages. someproject.github.io is always going to be different than someotherproject.github.io because github.io is serving the content, but is not the ultimate owner and thus the subdomains are legitimately different organizations in most cases.