password-manager-resources

Some of your points are addressed by: https://github.com/apple/password-manager-resources

I don’t get this complaint. Apple’s password generation and quirks “database” is open source and anyone can use it and do a pull request https://github.com/apple/password-manager-resources/tree/mai...

Obligatory: open source password rules and other info that anyone can use to generate passwords and contribute to the list. It’s used by WebKit. https://github.com/apple/password-manager-resources/tree/mai...

Apple/OP actually maintains a list of crowdsourced password rules for websites https://github.com/apple/password-manager-resources/blob/mai...

If Apple’s password manager required websites to indicate compliance before generating passwords for them, it would defeat the goal of a password manager to work with existing sites. It’s not like Apple invented the idea of a password manager. Reasonable sites should already allow passwords of the sort Apple generates, because they tick the usual boxes (length, entropy, and the pointless at-least-one-uppercase/digit/punctuation requirement). Now, many websites are not reasonable and enforce even-more-pointless requirements. Apple tries to mitigate this with a hardcoded list of popular websites’ password policies [1], which is used to tailor password generation for those websites. To be fair, this approach doesn’t scale for smaller websites. But there’s not much more Apple could do. In any case, at this point websites have had many y

They do have a big list of exceptions for password rules, you can find more details here. Seems they are collaborating with some other password tools, so maybe at some point switching products won’t help? Not sure. Bit Warden seems to make no attempt as this currently: https://rmondello.com/2024/09/29/new-quirks-who-dis/ https://github.com/apple/password-manager-resources/blob/mai... But you can also fix it yourself if it fails. How is detailed here: https://support.apple.com/en-au/guide/iphone/iphf9219d8c9/io...

Even Apple was so annoyed at this themselves that they actually went for a full open-source open-for-contributions GitHub repository at https://github.com/apple/password-manager-resources to get around these issues. > Many password managers generate strong, unique passwords for people so that they aren't tempted to create their passwords by hand, which leads to easily guessed and reused passwords. Every time a password manager generates a password that isn't compatible with a website, a person not only has a bad experience but a reason to be tempted to create their password. Compiling password rule quirks helps fewer people run into issues like these while also documenting that a service's password policy is too restrictive for people using password managers, which may incentivize the services to change.

Check out https://github.com/apple/password-manager-resources

https://github.com/apple/password-manager-resources/blob/mai... For being "quite obscure", I've at least heard of most of these sites before. Banks with "maxlength: 8", you love to see it.

Apple has a list of websites with quirks that don’t support its “generate strong passwords” feature even though there is HTML spec where you can specify the types of passwords you support. https://github.com/apple/password-manager-resources Many of these sites are quite obscure.

If it‘s worth the effort to you, you can try to amend the password rules here: https://github.com/apple/password-manager-resources/blob/mai...

You might be thinking about: https://github.com/apple/password-manager-resources or the related: https://github.com/w3c/webappsec-change-password-url But mainly if you are responsible for a system and you're willing to do work to improve security your first focus should be "implement WebAuthn so my users can stop worrying about passwords entirely" not "I wonder if more complicated password handling would help somehow?"