Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

4 Answers 4

Check out the question/answers to the StackExchange question What type of Password Reset/Forgot Password (verification) mechanism would you recommend. It analyzes the two major methods: "Secret question" and "Reset email".

If you'd like to review an in-depth analysis of weaknesses to various methods/implementations (written by Ron "iagox86" Bowes):

Now for an aside regarding password hashing. If you are able to send cleartext passwords, you are doing it wrong from the very start. And by this I mean you are storing cleartext without employing password hashing. Please read about why passwords should be hashed. There is no need to sit around thinking about whether or not it's appropriate to send user's their password: it should not be possible to do so.

share|improve this answer

I have not actually seen many sites sending you the new password over email. The more common situation is where the site sends you a link which allows the user to reset his password.

Is email a secure medium? No. Are there better alternatives? Probably, but implementing it would cause too much of a hassle to the average user which might lead to him just giving up using the site. It is all about balance, balancing the usability of the site against securing it.

share|improve this answer

The article is correct in asserting that email is a poor medium by which to send a password but incorrect two ways.

First, it assumes that passwords are being stored in plain text by the service provider because a plain text password is being emailed out. It is more likely that a service provider just generated a new password, in which case it knows the plain text value. Then, it sends the plain text to the user but hashes it for storage (hopefully).

Second, it assumes that the service provider's 'forgot password' mechanism provides no time out for the new password. It doesn't really matter whether it is the new plain text password or a URL that was sent to the user. The key is that the window for changing the password be kept very short (a couple of minutes) so that "searching for 'password'" in someone's email yields useless results.

share|improve this answer

There are different methods to reset passwords, generating a new password and sending that password to a user and then immediately letting them change the password (or using a special token) is common practice.

This does not mean the password is saved plain text! (this is very bad practice).

The truth is that in a perfect world we would be able to encrypt tokens/temporary passwords with GPG, but in practice this is not possible (users don't have patience for this).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.