Another reason not to change IdP hostnames

[Wessel, Keith]

True, but since you can't specify on the login form what password stores are permissible, you're trusting the user to make that call. It's, unfortunately, an all-or-nothing deal. That's why I suggest disallowing it for the sake of security but at the risk of making some users unhappy. It's the age old question: do you protect the users from themselves?

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Rainer Hoerbe
Sent: Monday, October 03, 2016 11:44 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Another reason not to change IdP hostnames


> Am 03.10.2016 um 18:39 schrieb Wessel, Keith <kwessel at illinois.edu>:
> 
> Seems like a better solution for something as central as the IdP would be to mark the password field on your login page as not allowed to be saved.

Which disables solutions that store browser passwords in keystores with strong encryption.

- Rainer

> 
> Or are some browsers ignoring that mark-up these days?
> 

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net