Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added shared credentials for Digi #772

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Added shared credentials for Digi #772

wants to merge 2 commits into from
+17 −0

Conversation

revolter
Copy link
Contributor

@revolter revolter commented Jun 23, 2024 •
edited
Loading

Overall Checklist

for password-rules.json

  • The given rule isn't particularly standard and obvious for password managers
  • Generated passwords have been tested from this rule using the Password Rules Validation Tool
  • Information has been included about the website's requirements (eg. screenshots, error messages, steps during experimentation, etc.)
  • The PR isn't documenting something that would be a common practice among password managers (e.g. minimal length of 6)

for change-password-URLs.json

  • There is no Well-Known URL for Changing Passwords (https://example.com/.well-known/change-password)
  • The URL either makes the experience better or no worse than being directed to just the domain in a non-logged-in state

for shared-credentials.json

  • There's evidence the domains are currently related (SSL certificates, DNS entries, valid links between sites, legal documents etc.)
    digi.ro digionline.ro
    https://who.is/whois/digi.ro https://who.is/whois/digionline.ro
  • If using shared, the new group serves login pages on each of the included domains, and those login pages accept accounts from the others. (For example, we wouldn't use a shared association from google.co.il to google.com, because google.co.il redirects to accounts.google.com for sign in.)
  • If using from and to, the new group, the from domain(s) redirect to the to domain to log in.

for shared-credentials-historical.json

  • You believe that the domains were associated at some point in the past and can explain that relationship

@rmondello
Copy link
Contributor

One of the linters is failing because we currently don’t allow overlapping rules. I’m thinking about what to do with this.

@revolter
Copy link
Contributor Author

Want some help?

rmondello
rmondello reviewed Jun 23, 2024
View reviewed changes
quirks/shared-credentials.json Outdated
{
"shared": [
"digi.ro",
"digionline.ro"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe the expedient thing to do here is move “digionline.ro” into the “to” of the other rule, even if it’s not 100% accurate. What do you think?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense

Copy link
Contributor Author

@revolter revolter Jun 23, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, digionline.ro is NOT obsoleted, so I'm not sure what implications does this change have.

Would

{
    "from": [
        "digionline.ro"
    ],
    "to": [
        "digi.ro"
    ]
},
{
    "from": [
        "digiromania.ro",
        "rcs-rds.ro"
    ],
    "to": [
        "digi.ro"
    ],
    "fromDomainsAreObsoleted": true
}

work?

Copy link
Contributor Author

@revolter revolter Jun 23, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would <...> work?

Nope, it wouldn't work:

$ ruby .github/workflows/lint-scripts/websites-shared-credentials-duplicates.rb
The domain 'digi.ro' appears more than once!

:(

rmondello
rmondello reviewed Sep 27, 2024
View reviewed changes
quirks/shared-credentials.json
@@ -135,6 +135,17 @@
"diversalertnetwork.org"
]
},
{
"from": [
"digiromania.ro",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see digiromania.ro redirecting. When I load it, it shows a page at that domain!

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Huh 🤔 Even in incognito?

$ curl --include digiromania.ro
HTTP/1.1 301 Moved Permanently
Date: Sat, 28 Sep 2024 07:24:40 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://www.digi.ro/
Server: RDS-WebServer v2

<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx</center>
</body>
</html>

rmondello
rmondello requested changes Sep 27, 2024
View reviewed changes
Copy link
Contributor

@rmondello rmondello left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you look into digiromania.ro not redirecting?

@rmondello
Copy link
Contributor

Closing for now. Feel free to re-open if you're interested in trying to get this landed.

@rmondello rmondello closed this Oct 7, 2024
@revolter
Copy link
Contributor Author

revolter commented Oct 8, 2024

I do. I was waiting for a reply from you here: #772 (comment)

@rmondello rmondello reopened this Oct 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rmondello rmondello rmondello requested changes

Requested changes must be addressed to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@revolter @rmondello