Send new password by email is bad practice but what to do if user forgot his password?

Question

According to http://plaintextoffenders.com/post/7006690494/whats-so-wrong-about-sending-a-new-password-in it's bad so what to do ?

Just ask him to set a new one ?

Answer 1

Check out the question/answers to the StackExchange question What type of Password Reset/Forgot Password (verification) mechanism would you recommend. It analyzes the two major methods: "Secret question" and "Reset email".

If you'd like to review an in-depth analysis of weaknesses to various methods/implementations (written by Ron "iagox86" Bowes):

• Hacking Crappy Password Resets Part 1
• Hacking Crappy Password Resets Part 2
• (Mostly) Good Password resets

Now for an aside regarding password hashing. If you are able to send cleartext passwords, you are doing it wrong from the very start. And by this I mean you are storing cleartext without employing password hashing. Please read about why passwords should be hashed. There is no need to sit around thinking about whether or not it's appropriate to send user's their password: it should not be possible to do so.

Answer 2

I have not actually seen many sites sending you the new password over email. The more common situation is where the site sends you a link which allows the user to reset his password.

Is email a secure medium? No. Are there better alternatives? Probably, but implementing it would cause too much of a hassle to the average user which might lead to him just giving up using the site. It is all about balance, balancing the usability of the site against securing it.

Answer 3

The article is correct in asserting that email is a poor medium by which to send a password but incorrect two ways.

First, it assumes that passwords are being stored in plain text by the service provider because a plain text password is being emailed out. It is more likely that a service provider just generated a new password, in which case it knows the plain text value. Then, it sends the plain text to the user but hashes it for storage (hopefully).

Second, it assumes that the service provider's 'forgot password' mechanism provides no time out for the new password. It doesn't really matter whether it is the new plain text password or a URL that was sent to the user. The key is that the window for changing the password be kept very short (a couple of minutes) so that "searching for 'password'" in someone's email yields useless results.

Answer 4

There are different methods to reset passwords, generating a new password and sending that password to a user and then immediately letting them change the password (or using a special token) is common practice.

This does not mean the password is saved plain text! (this is very bad practice).

The truth is that in a perfect world we would be able to encrypt tokens/temporary passwords with GPG, but in practice this is not possible (users don't have patience for this).