Another reason not to change IdP hostnames

[Christopher Bongaarts]

On 10/3/2016 6:13 PM, Eric Goodman wrote:
>> What's the markup? I know my mobile browsers tend to prompt me, but I
>> probably don't have that markup.
> I assume this is the autocomplete=off html tag. And even when honored by the browser (which according to Paul isn't often), plugins like LastPass, 1password, etc. would bypass the flag anyway. I still like to set it, nonetheless.

That's what we use, and it doesn't stop much these days.  Doesn't hurt 
anything though (apart from particularly persnickety HTML validators).

>
>> I guess there's an upside to forcing 180 day password lifetime.
> That was the best argument I ever heard for it. Today the number of uncontrolled devices and kiosks floating around with your auto-saved credentials can probably be out of control.

There was some desire here to strengthen our cautions to users to not 
save their password in their browser.  My take (which was pointed out 
with a smiley as being the "glass half full" perspective, is that 
everyone who called in because they forgot their autosaved password is 
immune to phishing attacks (which are a much more common risk that a 
Person of Ill Intent nosing around in your browsers data files these 
days...)

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%