What is the preferred way to provide a "password reset" functionality for an application installed on a mobile device?

In mobile applications, generally password reset works by sending OTP to the user's mobile. But this procedure seems risky in case the device is stolen. In that case, the attacker could request OTP and change the password and get credentials for the application.

Please suggest ways in which we could remediate this and make "password reset"" functionality secure

  • Do you mean the application (with change password functionality) is installed on the same device as configured for 2FA? – techraf Jul 6 '16 at 7:18
  • Your question is not quite clear. You have an application on a mobile. And this application needs a password the user has to enter? The user forgets the password and wants to reset the password? You do not want to send the password-reset to the mobile, since the attacker does not know the password and could trigger the password-reset, which would be sent to his mobile? If so - user OAuth. The application on the mobile has its own authentication token. The user can lock this token, if the mobile is lost. – cornelinux Jul 6 '16 at 9:24
  • 1
    Most users have a passcode or fingerprint lock on their phone – paj28 Oct 4 '16 at 10:07
  • Use a yubikey with NFC – Neil McGuigan Oct 4 '16 at 22:13

Authentication can be done in three ways:

Something you know (eg. a password)
Something you have (eg OTP)
Something you are (eg. a fingerprint)

So you can use any combination of two or all three for the password reset functionality. For example, if a user asks to reset password, you can ask the user a set of 2 questions and when he answers those correctly, you can send the OTP or the code to the mail ID.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.