I handle the process of password resets at the institution where I work. Currently, we require users to make up questions and answers (three minimum and five maximum); the questions cannot repeat, nor can the answers. When they forget their password, we require them to identify themselves by some known information (birth date and institution id) and then present them with one of their questions. This mechanism is causing us no end of headache, and I would like to replace it. I've read at least a couple answers here that I like, but I would like some thoughts on the following scheme:
- User is required to provide a recovery email address
- User forgets their password and goes to reset it. We present them with an obfuscated version of the email address they supplied and at least two more based on their recovery address, just at different providers, and make them pick the right one
- We send them a reset link to the right address if they picked it or we simply tell them we sent them a reset link if they picked the wrong one
- When they click the link they are required to fill in a captcha, or a code that was included in the email, in addition to their new password
When we get the capability, I'd like to offer SMS or an authenticator app instead of/in addition to email.
Does this seem sufficiently "secure"?