Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

You can see a link Forgot Password? nearby almost all login form.

As I mentioned in question, Since passwords are completely protected from outside access unless owner reveal, I come up with this question. I accept forgot password process highly secure. However I want to give my application little bit users-friendly.

I want just ignore the process like 1. Get user email id, 2. Generate temporary password/Encoded token. 3. Send it to user's email. 4. Force the user to sign-in their email 5. Get them back to application through attached link 6. Ask them into enter new password. and more if any further authentication needed.

Yes I can accept OAuth is in other hand. However, I just want to give dual password option to user, Instead of process OAuth. So that if user forgot the password, he/she can use second one and again get into application.

If I do these things, what are the security issues in that?

WorstCases If the user again forgot the password for Email account or account is deleted or removed. What would be the alternate way?

Why should I became a dependent of other guy(OAuth)?

share|improve this question
What makes you think that if a user cannot remember one password that they will remember two? – David Houde Mar 1 '14 at 8:09
@Davi It's a human brain... So It can be possible. In real, It happens – hilarudeens Mar 1 '14 at 8:12
Can you please clarify. You do or do not want the user to have to use the 6 steps to reset the password. The language barrier is tough on this one. – David Houde Mar 1 '14 at 8:14
@David On clearly saying, I don't want the user to follow 6 steps. – hilarudeens Mar 1 '14 at 8:15
So, like "security questions" (e.g. what is your mother's maiden name?)? – schroeder Jan 2 '15 at 19:27

First, this exists in practice in one form which isn't very secure: “security questions”. The second password is (if the security questions are used as intended) something that is easily memorable, but that is known by other people.

There is no security reason not to have two passwords: one for daily use, and one (longer, non-memorable) for recovery. Indeed, this is a common practice in certain scenarios, such as:

  • An enterprise setting where documents are encrypted with users' PGP keys, and also with an enterprise PGP key whose private part is kept in a safe and used only if no employee can be found to decrypt a document.
  • Mobile phones or SIM cards, which have a PUK (often 8 random digits) which can be used if the regular PIN (user-chosen, usually 4 digits) has been forgotten (or more generally if the device has been locked due to 3 incorrect PIN attempts).

The reason this is not done for websites is that there is very little point. If a user wishes to have a recovery password in case they forget their regular password, they can already do this by writing down their regular password. Unlike the enterprise case above, where the regular password and the recovery password (or key) are held by different entities, there is no difference in who holds the passwords.

You could follow the SIM card model and generate a long, random password that users could use for recovery. However, consider how would you communicate that password to users. You can display it on the site — and then most users would not pay attention to it and would therefore not have access to it when they're locked out. You can send it by email, in which case not only you depend on the email, but (unlike temporary password reset links, which are temporary), if the email is ever breached, so is the account, with immediate effect, and no need for the attacker to do any digging or to take any action on the site that would be logged.

Thus while dual password can work, it's an additional implementation effort and an additional attack surface for a very moderate benefit.

Furthermore, dual password would not eliminate the need for email as a recovery method. If the second password is forgotten as well, which is likely in practice, you need the email recovery.

If you choose to allow a second password, don't do it in the form of security questions: they weaken security, unless they are combined with other forms of authentication (and even then it often doesn't work out well). And don't expect more than a tiny fraction of users to make effective use of it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.