3

A particular service I use, when asked for a password reset, showed me an identifier on the website - something like 4562708546, apparently random or sequential.

They then sent me a new password over snail mail. Besides the (plaintext) password, the letter I received contains the identifier (4562708546), and asks me to verify that it is the same as the one the website showed me. The letter doesn't contain the username.

I've thought a bit about this, and can't figure out why they do it:

  • Only a single letter was sent, so a MITM interested in learning the password doesn't need to know the identifier to know the correct password
  • It could prevent accidental malfeasance in case a user receives a letter meant for someone else - but they would have no way of logging in without knowing the other person's username in the first place. And if they know the other's person username, it's probably not accidental.

What could be the purpose of such verification?

  • it would confirm that the person registered with that physical address triggered the reset – schroeder May 12 '16 at 21:10
  • 1
    @schroeder If they didn't trigger any reset - wouldn't they be surprised to receive one in the first place? And if they triggered another reset - does it matter? – goncalopp May 12 '16 at 21:19
  • Some sites will block subsequent reset requests until you've received the first password requested. Like an Amazon Dash button. =) I remember something like this from a health insurance provider... Is it just CYA security that looks good on paper? – Dave May 12 '16 at 22:58
2

It allows to identify the password reset attempt

Suppose that you request a password reset (new password: "12345"). However, the reset email is slow to come and, after waiting for some time you conclude if failed and make a second attempt (new password: "67890"). Meanwhile, the first email arrives. You open the password reset email and it tells you to enter the password/token "12345" in order to recover your account. However, and to your frustration, it simply doesn't work, complaining that it is invalid (but you have their email in front of you!) due to the fact that -unbeknownst to you- it is now expecting "67890".

If there was such identifier (and you compared it), you would be able to notice that it is not the same attempt, and wait for the second email to arrive. Even if you had received both emails, the identifier could allow you to select the right one.

Personally, it doesn't seem a very appropriate method. I would recommend providing a timestamp instead. The password reset email should contain the timestamp at which the reset attempt was made for logging. Mentioning “make sure that the email is for the reset request at xx/yy/zzzz hh:mm:ss” would be much clearer.

Another option is that it is intended to avoid people following links on fraudulent password reset emails. But if you didn't make such request then, by definition you would not have any to compare with, and thus I doubt it protects you from anything.

PS: Additionally to the above, they should be emailing tokens, not passwords (or at least forcing them to be changed on the next login)

  • Considering this is a physical letter, and not a email, I think the second option is excluded. But I can see the first being a issue - especially since it took a whole week to arrive! – goncalopp May 14 '16 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.