Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm one of the co-founders of plaintextoffenders.com. We recently received a submission for which I'm not sure if there is a means of attack or not. The site in question is a hosting/VPS/etc. company.

Once someone clicks on Forgot Password, an email is sent to the user's email address. It specifies a password reset address (good) which is time-limited to 15 minutes (excellent) but also contains the user's temporary password for those 15 minutes (huh?).

While this is clearly not an indication that they are storing passwords in plain-text, it got me thinking whether sending the temporary password, along with the time-limited reset link, had any security implications.

Update: After reading your answers and going through the wording of the email carefully, I've found that the password supplied is not the temporary post-reset password, but the password that will be used permanently after the reset link has been clicked. This fits in with our mandate and the post will be published. Thank you all for your answers!

share|improve this question
add comment

5 Answers

A "password reset address" is a temporary password -- and one that can be leveraged into a permanent password. A "password" is a piece of information that a user can present to be granted access. The "password reset address" fits that definition.

So I would say that the particular bridge of "password over email" has been crossed already. The inherent risk of such sending is mitigated by making the address applicability limited in time -- just like the "temporary password".

One could argue that the "temporary password" is a bit more risky in the following sense: if an attacker eavesdrop on the email, he can use both the password reset address and the temporary password, but using the temporary password leaves fewer traces, whereas actually resetting the password will be easily spotted by the rightful owner, on account of him not being able to log on any more. The difference is slight, though. I would say that the "temporary password" feature is quite useless but not significantly more risky than the password reset address itself.

(I suppose that the "temporary password" is for people who need access fast but don't want to break their own, cumbersome, slow password renewal policy. An edge case to help people who happen to dig their own grave.)

share|improve this answer
    
The temporary password exists in this case only in conjunction with the password reset address. –  Omer van Kloeten Aug 2 '13 at 21:36
add comment

My gut feeling is that there is probably little to no risk; assuming that the application correctly verifies that the particular password is only valid for 15 minutes.

As most hacking attempts aren't targeted, it is very unlikely that if the password somehow falls into the hands of an attacker, he will be able to exploit it within the very small window of opportunity.

However, there still isn't a point in sending the password along with a password reset URL. It is still better to remove it.

It all comes down to the profile of the website. If it's a banking or highly confidential web application, don't do it. There might be attackers planning targeted attacks against your users. For most web applications though, I don't see much of a risk.

share|improve this answer
    
It's a hosting company. I'll add that point to the question. –  Omer van Kloeten Aug 2 '13 at 12:56
    
It also depends on the complexity of the password. If it's <8 chars and the hash is a single crypto hash (e.g. SHA1) you could likely crack it in 15 minutes on a decent GPU cracking rig. –  Polynomial Aug 2 '13 at 13:10
    
@Polynomial But that would assume the attacker manages to dump the database within that 15 minutes. Offline password cracking really isn't an issue here really. –  Terry Chia Aug 2 '13 at 13:23
    
Good point. I'm not with it today. Blame the dog that woke me up at 6am. –  Polynomial Aug 2 '13 at 14:35
    
@Polynomial Damn dog... –  Terry Chia Aug 2 '13 at 15:06
add comment

The main advantage I could see here is that it (kind of) helps prevent attacks on the reset links. If a short link token is used, in theory someone could just keep guessing links.

Breaking it up in to multiple pieces that require a username, password sent via e-mail and link sent via e-mail IS more secure than simply a link of the same length since it protects further against people just trying to guess password reset links, but just as much security could be obtained by simply using a longer token in the password reset link. Might be some technical limitation to the system that prevents a longer token though. Either you need username + reset link token + temp password or you need username + longer reset link token. The sum total entropy is all that matters since e-mail leak is equally problematic for either.

share|improve this answer
add comment

To, so clarify, requesting a PW reset from this site will immediately do so (hence a temp password; the reset link should bypass login credentials because that's the point) but then has a time-limited reset link that will allow them to specify a new one?

So what happens if the time-bombed link and password expire? Is the user account locked down until the user responds to a subsequent reset e-mail in time? I could see that being a playground for a script kiddie feeding in as many e-mail addresses as he can find (and for sites which cater to corporate customers, using corporate e-mail addys of the form first.last@corpdomain.com, all you would need is the e-mail domain and a company phone list to shut down an entire company's access to this third-party site).

Obviously, the password-reset-over-email system provides two-factor authentication which is typically a good thing. The fact that the temp password is transmitted in more or less plain text is worrisome, but your attack vector in that case is someone sniffing the email server's network traffic, which is a couple of levels of sophistication above the average script kiddie or spambot.

The entire scheme, of course, is weak against an attacker who can crack the e-mail account password; if he's gained access to the GMail account you used to register with the site, he can reset both passwords and you're SOL, but that's true of any reset-by-email scheme, and it's still better than using publicly-available "secrets" like your mother's maiden name, your high school, or other easy-to-research security questions.

share|improve this answer
add comment

The weakness I see is that there is a potential for defeating the goal of the system if the user's old password does not get locked out.

If you are sending an email to someone letting them reset the password without knowing the current one (the typical "forgot the password" case), anyone who has compromised the email account can take control of the password protected system. This is a natural part of the compromise provided by "forgot the password" systems.

However, one important thing about this process is that, even if the attacker does have the email system compromised, they cannot attack the password protected system, and leave undetected. They always had to change the password, which is a small but detectable amount of change.

If the system allows you to use the temporary password, but after 15 minutes it lapses back to the original password, then the system is less strong. Now the attacker can use the temporary password for 15 minutes, delete the email, and the victim is none the wiser. However, if the system disables the original password immediately when you send the "forgot the password" message, it is safe. Likewise, it is also safe if that temporary password can only be used to change the password, not to access the site.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.