I am having a fight with the "Security Expert" of my team about this very basic question and I need help in getting a good valid argument(s).
The pretext is as follows: Should it be possible/valid to try to guess/brute-force passwords for every known User of the Application, using "Change Password" link for a single User??
I asked him this very simple question: We get a 'Change Password' weblink for each account when someone asks for change password, and it seems that using that 'Change Password' link you can try to guess password each and every user of the application. Is this valid for a 'Change Password' functionality?? He said: "Yes, that's fine"
So, basically when someone asks for a "Change Password" option from our software, they get a weblink. Now it seems that using that link it is possible to try to make brute-force requests for "Change Password" for All the users of the application. My Security Expert's point is the same is also possible from the main "Login Page" as there also one can try to brute-force the password change for every user hence he is oblivious (against any need for changes!!) to the "Change Password" feature against this issue. The same brute-force detection logic seats beneath both the "Change Password" page as well as the "Login Portal" page.