Pros and cons of this password reset scheme?

Question

I handle the process of password resets at the institution where I work. Currently, we require users to make up questions and answers (three minimum and five maximum); the questions cannot repeat, nor can the answers. When they forget their password, we require them to identify themselves by some known information (birth date and institution id) and then present them with one of their questions. This mechanism is causing us no end of headache, and I would like to replace it. I've read at least a couple answers here that I like, but I would like some thoughts on the following scheme:

1. User is required to provide a recovery email address
2. User forgets their password and goes to reset it. We present them with an obfuscated version of the email address they supplied and at least two more based on their recovery address, just at different providers, and make them pick the right one
3. We send them a reset link to the right address if they picked it or we simply tell them we sent them a reset link if they picked the wrong one
4. When they click the link they are required to fill in a captcha, or a code that was included in the email, in addition to their new password

When we get the capability, I'd like to offer SMS or an authenticator app instead of/in addition to email.

Does this seem sufficiently "secure"?

Answer 1

User forgets their password and goes to reset it. We present them with an obfuscated version of the email address they supplied and at least two more based on their recovery address, just at different providers, and make them pick the right one

If the emails just differ by the email providers then it might be easy to guess. There is a good chance of picking the institutions domain name or the most popular domain in the region.

Differ the emails in some other ways in addition to this. For example, adding random numbers, institution name, last name, initials after a dot, etc... at the end of the email.

We send them a reset link to the right address if they picked it or we simply tell them we sent them a reset link if they picked the wrong one

This is a good step in my opinion.

When they click the link they are required to fill in a captcha, or a code that was included in the email, in addition to their new password

Links in each email will be unique, so you will know which email belongs to these links without a manual code. If the purpose of the code is making sure that he is a human, you can use a ReCaptcha. It is more suitable than a code.

However, I would suggest adding ReCaptcha at the beginning of the process instead of the end. You could add ReCaptcha to the page where the user selects the email.

Answer 2

The process is mostly "secure enough". E-mail is not considered a secure method of communication, but it's a commonly accepted trade of security for usability.

However, step 2 (where you present three scrambled email addresses) seems dubious. Depending on the implementation, it could at worst leak all the emails in the database, and at best makes the attacker try three times instead of one. It provides no tangible security, so I would recommend skipping it.

I'll describe some of the possible implementation below, in the hope that they will demonstrate why I think step 2 is dubious:

---

Worst implementation: You randomize the other emails and how emails are scrambled each time. The attacker discards the fake emails easily (only one address is the same each time). Then the attacker combines "john****@gmail.***" and "*****_doe@*****.com" and learns that your email is "[email protected]". Repeat for every user in the database.

Marginally better: You store the two fake emails in the user account and present them every time. Now they cannot be trivially dismissed.

Better, but still bad: You scramble the email once, and present that every time. Now the attacker doesn't learn more each time he refreshes the page. But if your user name is john_doe, it's not hard to guess "john****@gmail.***". Or an attacker could use the scrambled version to filter lists of leaked accounts, and possibly get a list of re-used passwords to try as a bonus.

Best implementation: You store two fake and one real email domains in the user account, then only reveal those (e.g. [redacted]@gmail.com). An attacker learns which three e-mail provides you may have used. This can be an acceptable trade-off to remind the user which email they signed up with, but the usefulness is somewhat negated by the fake choices.