Can someone suggest a federated protocol for password changing so my password manager can rotate passwords on my behalf in breaches and just every month or so?
I wrote two blog posts on this idea a few years ago, but alas no credible player has pursued documenting a standard protocol for this. Password managers are, probably pragmatically, writing custom scrapers for major sites instead.
It's all manual. Take a look at what Dashlane is doing (essentially writing a plugin for each site).
Ah the old "let's bother the user with BS password rules so we can store them in plaintext or md5'd on our DB"