0

In most, if not all, web forms for logging into a site, you have your forgot password link. When clicking the link, you get a new form (usually in a new page) either empty (!) or prefilled with the email address you put in the login form, where you have to click again to actually get the site to send the reset password link.

I think what should happen is that when clicking over the forgot password link, a reset password link is automatically sent. Then the link text changes to "Reset password link sent to [email protected]" until you enter again a wrong password.

Is this worse in any way than the standard procedure, security-wise?

PS: The UX side of the question's here.

PS2: I'm thinking about sites where your username is your email address (of which there are aplenty), otherwise BadSkillz's answer points to a very valid information leak risk which could be mitigated via changing the message.

Improve this question
2
  • Is this worse in any way than the standard procedure, security-wise?: what is this standard procedure you are comparing with?
    – user45139
    Commented Aug 20, 2015 at 10:11
  • First paragraph describes the standard procedure. Second paragraph suggests my improvement, @begueradj
    – Vinko Vrsalovic
    Commented Aug 20, 2015 at 10:30

1 Answer 1

Reset to default
1

This makes (somewhat) sure that you really are the user associated with the account, you should at least know what email address was used to create the account.

Filling the email address automatically could already give an attacker the opportunity to get all the email addresses in the database, just request a new password for every account you can think of. The same goes for showing the message "an email has been send to [email protected]". Now you have the email associated with the account and had the server send an email. Imagine doing that 1,000,000 times.

Improve this answer
2
  • I was thinking about sites where your is your email so there's no information disclosure risk. But that's correct, if users are not emails then that's a real risk you could mitigate by saying instead "an email has been sent to your registered address"
    – Vinko Vrsalovic
    Commented Aug 20, 2015 at 9:24
  • Similarly this can be used to discover if an email address has been registered with a site; but this can be gotten around by changing the message to something like "If the email address is registered with us, a reset password link has been sent".
    – Chris Murray
    Commented Aug 20, 2015 at 14:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .