4

I handle the process of password resets at the institution where I work. Currently, we require users to make up questions and answers (three minimum and five maximum); the questions cannot repeat, nor can the answers. When they forget their password, we require them to identify themselves by some known information (birth date and institution id) and then present them with one of their questions. This mechanism is causing us no end of headache, and I would like to replace it. I've read at least a couple answers here that I like, but I would like some thoughts on the following scheme:

  1. User is required to provide a recovery email address
  2. User forgets their password and goes to reset it. We present them with an obfuscated version of the email address they supplied and at least two more based on their recovery address, just at different providers, and make them pick the right one
  3. We send them a reset link to the right address if they picked it or we simply tell them we sent them a reset link if they picked the wrong one
  4. When they click the link they are required to fill in a captcha, or a code that was included in the email, in addition to their new password

When we get the capability, I'd like to offer SMS or an authenticator app instead of/in addition to email.

Does this seem sufficiently "secure"?

  • It is secure enough for me. If hackers use it to take over a user's account, it is no skin off my nose. Is it secure enough for you depends on what you are trying to protect and how valuable it is. If it is an extremely valuable resource, then I would make users come in person. If it was worthless, I would not even bother with passwords. – emory Feb 12 '16 at 22:09
  • 3
    Can you clarify how during step #2 you are identifying the user? Do they have a username they supply to you that is different from their registered email address? – PwdRsch Feb 12 '16 at 22:12
  • 1
    What threat are you trying to avoid by including a captcha/code in the email while making them click a link, and the obfuscated email scheme. I don't see the additional benefit over having them provide an email to reset the password for. – user72066 Feb 12 '16 at 23:48
  • Maybe you offer an option to text them a verification code/link – Ramrod Feb 13 '16 at 4:21
  • 1
    I agree with @Wrathbelle that the CAPTCHA/code seems to not add anything in terms of protection. Choosing the correct email address among a number of fake ones seems sufficient, and satisfies the "manual step" that you're looking for. Adding the SMS/authentication app layer on top of this would be another layer of protection, but to emory's point: how many layers you want depends on the assets you're guarding. – user171922 Mar 8 '18 at 5:03
2

User forgets their password and goes to reset it. We present them with an obfuscated version of the email address they supplied and at least two more based on their recovery address, just at different providers, and make them pick the right one

If the emails just differ by the email providers then it might be easy to guess. There is a good chance of picking the institutions domain name or the most popular domain in the region.

Differ the emails in some other ways in addition to this. For example, adding random numbers, institution name, last name, initials after a dot, etc... at the end of the email.

We send them a reset link to the right address if they picked it or we simply tell them we sent them a reset link if they picked the wrong one

This is a good step in my opinion.

When they click the link they are required to fill in a captcha, or a code that was included in the email, in addition to their new password

Links in each email will be unique, so you will know which email belongs to these links without a manual code. If the purpose of the code is making sure that he is a human, you can use a ReCaptcha. It is more suitable than a code.

However, I would suggest adding ReCaptcha at the beginning of the process instead of the end. You could add ReCaptcha to the page where the user selects the email.

  • 1
    Yeah, the place for a CAPTCHA is before the password reset email gets sent. There's no point having a CAPTCHA in the page that the password reset email links to. If you think there is, you need to make your password reset links (the ones in the email) way more secure. They should include high-entropy, cryptographically random strings of a suitable length (128 bits is a reasonable minimum) or cryptographically-signed tokens (such as a JWT, though that's more effort than it's worth here, just use the random token). The tokens must be short-lived and single-use-only. – CBHacking Jun 26 at 21:26
1

The process is mostly "secure enough". E-mail is not considered a secure method of communication, but it's a commonly accepted trade of security for usability.

However, step 2 (where you present three scrambled email addresses) seems dubious. Depending on the implementation, it could at worst leak all the emails in the database, and at best makes the attacker try three times instead of one. It provides no tangible security, so I would recommend skipping it.

I'll describe some of the possible implementation below, in the hope that they will demonstrate why I think step 2 is dubious:


Worst implementation: You randomize the other emails and how emails are scrambled each time. The attacker discards the fake emails easily (only one address is the same each time). Then the attacker combines "john****@gmail.***" and "*****_doe@*****.com" and learns that your email is "john_doe@gmail.com". Repeat for every user in the database.

Marginally better: You store the two fake emails in the user account and present them every time. Now they cannot be trivially dismissed.

Better, but still bad: You scramble the email once, and present that every time. Now the attacker doesn't learn more each time he refreshes the page. But if your user name is john_doe, it's not hard to guess "john****@gmail.***". Or an attacker could use the scrambled version to filter lists of leaked accounts, and possibly get a list of re-used passwords to try as a bonus.

Best implementation: You store two fake and one real email domains in the user account, then only reveal those (e.g. [redacted]@gmail.com). An attacker learns which three e-mail provides you may have used. This can be an acceptable trade-off to remind the user which email they signed up with, but the usefulness is somewhat negated by the fake choices.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.