Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If I receive an email with a plain text generated password (in response to a password reset request), is this a vulnerability? The password expires after one use, in other words the user has to change their password as soon as they register.

I could imagine that such an password reset scheme would at least be vulnerable to a man in the middle attack. The man in the middle could get the temp password and then lock out the user with a new password. But is there perhaps another vulnerability?

share|improve this question
    
The "password" which you get for resetting accounts are actually most of the times "unique" strings. The problem may occur on how these strings are generated. For example if the string is not generated randomly enough like this $code = md5(time()); then you may be vulnerable so that the attacker can "guess" by using some bruteforce-fu. –  HamZa May 15 '13 at 22:10
1  
@HamZaDzCyberDeV MD5 isn't collision resilient so you could get the same key on accident from some other input. win.tue.nl/hashclash/… –  AbsoluteƵERØ May 16 '13 at 21:06
add comment

2 Answers

I don't think it's a vulnerability. When you think about it as a password sent in plaintext, then yes it's understandable to think there's a vulnerability here, but it's not a password.

Sending you a link like https://example.com/reset.php?code=97fy978y39fny39478fyn3 which is a one-time link that you click to be taken to a password reset form in which you type your new password, is essentially the same as sending you a one-time password, they just took the code from the link and called it a temporary password. The idea itself isn't vulnerable, but the incorrect implementation mostly is.

What could go wrong here?

  1. The code or the password could be very short and/or no generated with a cryptographically secure PRNG.

  2. The code or the password could give access to areas of the account for an extended period of time before setting a new password.

  3. The code or the password could stay valid for a long time, making their eventual exposure a risk.

  4. Not using HTTPS, which gives a MitM a chance to intercept them.

Update: You're correct, email is outside the scope of the implementation, but then we'd go completely off-topic. We can discuss that the whole system is broken, but there's no other option. They could send you the code in an SMS, but what if your friend was holding your mobile? They could send it to your mailbox (kind of silly) but what if somebody opened your mailbox? The only secure option left is that they send a representative of the company to go to your address and ask you for your ID and take your fingerprints (which you've given on the registration form) and then reset your password.

You see, the email is de facto way to contact the original account owner, so that's the best they can do.

All in all, I was just trying to show you that the security of the plaintext one-time password is exactly the same as the one-time link used by almost all web services (Facebook, Twitter, StackExchange, ...)

share|improve this answer
    
You say the idea is not vulnerable, only an incorrect implementation, however one detail is outside the implementation, the email access. There is no way for the implementation to ensure that the email client is using https. –  dasPing May 15 '13 at 22:38
    
@dasPing I've responded as an update to answer. –  Adnan May 16 '13 at 5:45
    
Storing the user-agent that requested the token along with it, and making sure the same UA access the link is going to improve the security at all or not? Or it's an unecessary layer? –  JCM Jan 22 at 18:10
add comment

Assuming that the password is randomly generated and not easily guessed, as you say the main way in which an attacker would compromise this system is to perform a MITM attack.

However any e-mail address based password reset system is vulnerable to the same kind of issue (e.g. one-time links) if the attacker can intercept traffic between the user and their e-mail account.

Whilst it's definitely not perfectly secure or something I would rely on for a high-risk application (like online banking) I don't see one-time passwords as a particularly poor system either.

the main recommendation would be to ensure that you access your e-mail account only over encrypted channels (e.g. SSL or IMAP(S))

share|improve this answer
    
Good point. The one time link is just as vulnerable. It could be just as easily sniffed as the plain text password. –  dasPing May 15 '13 at 22:53
    
One-time passwords not secure enough. infosecisland.com/blogview/… –  AbsoluteƵERØ May 16 '13 at 21:38
    
@AbsoluteƵERØ reading that article, two points 1) you're mixing terms I'm talking about one time passwords in the sense that OP used it not in the sense of google authenticator, second whilst that article has a rather inflammatory title, if you read the text of it, it says that google authenticator style OTP is a lot better than any single factor solution (e.g. anything that is just username/password) –  Rоry McCune May 17 '13 at 6:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.