2

Is it a good idea in terms of security to reset your password every time you login and just fill your password with a bunch of random symbols, letters and words that you don't memorise?

Since passwords with larger entropy have better security, why not fill it with a long random string of symbols, words, numbers and simply use your email to reset it every time you try to login and afterwards delete the mail that they sent you for recovery. [Or SMS to phone]

What is the reason (security mainly) that this idea is not suggested much? [Excluding the fact that its troublesome to some people]

Improve this question
4
  • Your E-mail account is protected with a password, I suppose? What happens if you lose control of your E-mail account, or your phone?
    – gbroiles
    Jan 23, 2017 at 2:21
  • This will be done on emails, resetting done on phone via SMS. But lets say we don't consider the case of "phone to be lost" since that is a bit of hardware problem.
    – Kaynnc
    Jan 23, 2017 at 2:25
  • Possible duplicate of Security of Yahoo's new authentication: On-demand password
    – PwdRsch
    Jan 23, 2017 at 2:46
  • Because using one time password with TOTP like Google Authenticator is much more user friendly and have better security properties?
    – Lie Ryan
    Jan 23, 2017 at 2:58

1 Answer 1

Reset to default
3

Slack does something similar: instead of logging in with your password, you have an option to receive an e-mail to a registered account with a one-time login link. Clicking on the link logs you in. So this is used a bit :)

The main issue with your suggested scheme is indeed the convenience issue. Notably:

  • Login delay. Depending on current server load and your email provider, it can take between 5 seconds and 10 minutes to receive an e-mail with a reset link. If you're logging into something like your bank account, which you log in at least daily and always log out, this wastes quite a bit of time unless your workflow is well-planned around it.
  • Password reset procedure might get broken after site update. Broken login is likely to be spotted immediately, but password reset is used much less often, and this would take longer time to spot and fix.
  • Password reset procedure might be insecure itself. Some sites would even generate and send you a new temporary password by email (ughh!) - and some of those passwords I've seen were very weak.
  • Password reset procedure might be quite complex (asking username, security questions, some other info about you, then letting you to choose a password, and then you have to log in with this password). This would make login quite burdensome.
  • In this scheme your email is essentially the key to everything, and if it gets hijacked, blocked or deleted (such as when Lavabit shut down their email server - imagine if you had that email as registered?), you're now in a really big trouble, since you don't know any of your passwords and have no means to easily reset it.
  • Finally, after many resets your account might get locked on the server - it is unusual behavior for users to reset password daily, so it depends on how zealous their fraud department is. In this case the customer support would not be likely able to do anything for you besides unlocking your account once, and telling you that it might get locked again tomorrow if you reset your password again.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .