Nowadays, when everyone tries to be more secure then each other, when companies spend billions on information security, it seems a little bit odd that the password reset left behind, the place that, in my opinion, should be everyone's concern, still relies only on the email provider.
Sending passwords in email is a bad idea. We all know it. Who knows how secure the email provider is? Who knows whether the email account was hacked? Who knows who's listening in between (man-in-the-middle)? etc... Because of that, almost no one sends passwords in emails.
But what about password recovery? Most of the websites just send a link via email, and after clicking on it, you can change the password. So no matter how secure the website is, it's pretty easy to hack a user, isn't it?
So how can I make a secure password reset system, without trusting the email provider?
I'm looking for a solution that will apply to everyone, without using other resources like SMS (which also not that secure). I'm looking for an answer that programmers with no budget what-so-ever still would be able to use it.
Here are some things I thought about:
- security questions - nowadays everyone can find anything about anyone online, so those questions are not that secure.
- Recovery code - be honest with me. If a website would ask you to print and save a recovery code, would you? Almost no one would. And if they did, they'll probably lose it after a while...