Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I can't recall a website that after resetting my password I was automatically logged in, I had to type the password again - which seems quite silly.

From a security perspective, why do websites do that?

share|improve this question
1  
There is also a usability perspective. You are less likely to forget the password if you are forced to enter it immediately. –  Deer Hunter Aug 16 '13 at 13:51

3 Answers 3

From a security point of view, whether the "password reset" logs you in automatically or not is rather neutral. Neither behaviour is inherently more secure than the other. I suppose that most sites do what was simplest to implement on the server side.

A point to consider is that security is achieved as long as everybody cooperates; in particular, the principle of least surprise is of paramount importance. That principle, applied to security, means that trouble is afoot when things don't occur as the human user expects it. In this case, the human user may or may not expect to be logged in after a reset. Let's see what happens if the user is "surprised":

  • If the user expected to be logged in, and is not, then he may be somewhat irked by the necessity to enter his password again. However, consequences stop there. Notably, the requirement to have to enter the password a third time will not induce the user to choose a weaker but easier to type password, because, by definition, he was not aware of this third entry when he chose the password.
  • If the user did not expect to be logged in after a password reset, and still is logged in, then that user may simply not notice that he is logged in, and remain so. This contradicts the user control of open sessions (the reason why most sites have a prominent "logout" button).

In that sense, a (rather weak) case can be made against logging the user automatically on password reset: security consequences of an unnoticed login can be worse than consequences of an unexpected lack of automatic login.

share|improve this answer

It's probably just to confirm he chose the right password, what happens if you browse away from the password page on the site?

Normally when you forgot a password a one-time token is generated (often a link) which allows you to change your password and then log in.

If they immediately log you in using the one-time token after which you can change your password, it's a bit weird but not entirely less secure. After all if you can change the password, you could easily log in afterwards anyway.

The important thing is to check if, after using the token, it is invalidated. If the token allows you to change your password over and over again, then there is indeed a security issue.

share|improve this answer

If you change your password, all of your existing login sessions might be cleared, so that a villain who has your password gets logged out, too.

The fact that you don't get logged in immediately afterwards, or that they don't preserve your current session might just be programmer's lazyness, or what Lucas said.

share|improve this answer
    
Mental -1 for the first line. Invalidating the previous sessions has nothing to do with the ability to create a new session for the user after resetting the password. After all, you trusted that he's the email owner and rest the password for him based on the token, so why not log him in based on the token? Your second point, however, is correct. It could be laziness. –  Adnan Aug 16 '13 at 14:30
    
@Adnan I think you and copy are pretty much saying the same thing. –  Iszi Aug 16 '13 at 14:32
    
@Iszi It's very likely that you're indeed right. –  Adnan Aug 16 '13 at 14:33
    
@Adnan Yeah, I get that a lot. ;-) –  Iszi Aug 16 '13 at 15:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.