Re: Password Playground

2014-10-16 Thread Shane Tomlinson
Hi Mark, I'm really down on browser-only password managers. A browser-only password manager is of limited use if it cannot be used to by standalone apps on mobile devices. Like ckarlof said in the referenced bug, password managers are useful when they can be used *everywhere* the users go. On

Re: Password Playground

2014-10-16 Thread Mark Finkle
- Original Message - If our solution had deep OS level integration and is usable by any app, like Keychain or Lastpass, then yes, that's awesome and you can ignore me. Otherwise, meh. I'm talking about OS integration (as much as the OS would allow and shooting for parity with other

Re: Password Playground

2014-10-16 Thread Shane Tomlinson
As soon as I hit send, I realized my message was very negative and not as constructive as I wanted it to be. I think any exploration into making password managers better is a step in the right direction, those explorations can be used to iterate and improve authentication not only for the

Re: Password Playground

2014-10-16 Thread Shane Tomlinson
Music to my ears. then yes, that's awesome and you can ignore me. Thanks for the clarification, Shane On 16/10/2014 12:05, Mark Finkle wrote: If our solution had deep OS level integration and is usable by any

Re: Password Playground

2014-10-15 Thread Shane Tomlinson
On 04/10/2014 02:54, Ryan Feeley wrote: As its a hash of your master password, it's safe to increment your master password by one as an exception. Here's an argument against this idea from Square: https://diogomonica.com/posts/password-security-why-the-horse-battery-staple-is-not-correct/

Re: Password Playground

2014-10-15 Thread Ryan Feeley
forget), then hashes the results with a host (such as github.com), and your settings for that host. If you enter the same inputs on another computer, 1SP will yield the same password. If you're referring to the Password Playground in general, we're addressing his primary concern which is how

Re: Password Playground

2014-10-15 Thread Greg Norcie
characters requirement. Even if worst case scenario, people reused their Password Playground generated PW elsewhere, at least that reused PW is stronger than what they were using previously. There's already been a lot of studies that a majority of people use dictionary words and other easily

Re: Password Playground

2014-10-15 Thread Chris Karlof
mobile edition Product Designer, Identity Mozilla UX IRC: rfeeley On Oct 3, 2014, at 7:49 PM, Chris Karlof ckar...@mozilla.com wrote: On Oct 3, 2014, at 7:22 AM, Ryan Feeley rfee...@mozilla.com wrote: I showed the password playground to a friend (and xoogler) yesterday who

Re: Password Playground

2014-10-15 Thread Greg Norcie
On Oct 3, 2014, at 7:49 PM, Chris Karlof ckar...@mozilla.com mailto:ckar...@mozilla.com wrote: On Oct 3, 2014, at 7:22 AM, Ryan Feeley rfee...@mozilla.com mailto:rfee...@mozilla.com wrote: I showed the password playground to a friend (and xoogler) yesterday who was strongly opposed to us

Re: Password Playground

2014-10-15 Thread jgruen
Since I’ve already got the prototype coded up (sloppily), I’d like to start porting it to FxA and making Ryan’s suggested tweaks. I think we’re a bit blocked by feature toggles, but might as well get the ball rolling. John Gruen Cloud Services UX jgr...@mozilla.com irc: jgruen On Oct 15,

Re: Password Playground

2014-10-15 Thread Mark Finkle
I'm not suggesting you stop with the prototype, but I am pushing Mozilla to add this kind of feature to Firefox itself, and allow all websites to have access to stronger password generation, saved to Firefox's password manager and sync'd across devices. We are already behind:

Re: Password Playground

2014-10-14 Thread Katie Parlante
On Oct 1, 2014, at 3:11 PM, Ryan Feeley rfee...@mozilla.com wrote: Katie, we’d also like to track impressions and click-thrus. How many people take advantage of a tool that helps them make a better password when it’s available? (you might see where we’re doing with this). When the time

Re: Password Playground

2014-10-03 Thread Ryan Feeley
I showed the password playground to a friend (and xoogler) yesterday who was strongly opposed to us deploying this on anything but one site (e.g. we should not make this available for other sites to use as a service on the web). If sites starting linking to the playground from their password

Re: Password Playground

2014-10-03 Thread Greg Norcie
To clarify: are we talking about generating mnemonics like in the playground in a menu item? - Greg On 10/3/14, 10:22 AM, Ryan Feeley wrote: I showed the password playground to a friend (and xoogler) yesterday who was strongly opposed to us deploying this on anything but one site (e.g. we

Re: Password Playground

2014-10-03 Thread Chris Karlof
On Oct 3, 2014, at 7:22 AM, Ryan Feeley rfee...@mozilla.com wrote: I showed the password playground to a friend (and xoogler) yesterday who was strongly opposed to us deploying this on anything but one site (e.g. we should not make this available for other sites to use as a service

Re: Password Playground

2014-10-02 Thread jgruen
Here’s the prototype I built for intern Greg this summer: http://people.mozilla.org/~jgruen/passwords/mnemonic/#mn-two Ryan, your mockup shows color changing letters in a textarea, whereas my prototype uses a second div to highlight first chars of each substring. Off the top of my head, IDK

Re: Password Playground

2014-10-02 Thread Jared Hirsch
On Oct 2, 2014, at 8:28 AM, jgruen jgr...@mozilla.com wrote: Here’s the prototype I built for intern Greg this summer: http://people.mozilla.org/~jgruen/passwords/mnemonic/#mn-two Ryan, your mockup shows color changing letters in a textarea, whereas my prototype uses a second div to

Re: Password Playground

2014-10-01 Thread Chris Karlof
Nick and Shane, also. I’m thinking something very quick and dirty here. Maybe something we can enable/disable with a feature toggle, or only show to a small number of users to start. -chris On Oct 1, 2014, at 3:11 PM, Ryan Feeley rfee...@mozilla.com wrote: Hi all, I had a chat with