0

Is it secure for a user to manually reset his password every login (via email or 2 factor authentication) to a random token via email or 2 factor authentication, when OTP isn't forced ?

I mean an attacker would need to gain access to the email to login, but if he is able to access the email, then he could circumvent the password by reseting it anyway.

  • 4
    You just described the "One Time Password" design pattern ... – schroeder Jun 1 '17 at 8:15
  • As @schroeder says you've described the basis of a OTP. But to answer your final question about "reduce security-level" the important part is to ensure the source of the one time password remains secret only to you. Loosing (or having compromised) the device/application that generates the token/password would render the security useless. Also, you need to ensure the channel in which the token is transferred over to yourself is secure from active/passive attacks (this avoids an attacker using the token themselves). – ISMSDEV Jun 1 '17 at 8:46
  • its like RSA token generation technique... – Ali786 Jun 1 '17 at 8:49
  • 1
    Ok so to answer the question. Yes it is. But I don't see it adding any more security than leaving the password alone. Most sites allow using the original password until a rest completes. So someone who captures your current password would still be able to login until you change it again. It would though render older captured passwords useless - asking as you never reuse them – ISMSDEV Jun 1 '17 at 8:53
  • 1
    @HopefullyHelpful The OTP pattern is secure in principle, so, using the same process yourself is also secure, in principle. But the devil is in the details ... – schroeder Jun 1 '17 at 9:27
1

I cannot see any direct security problems, but there can be side effects.

On some systems, the user and/or the admins are warned that a password was changed. Changing a password everyday could add noise there. Another possible test is that changing very often a password could be an indicator that something weird happens with that account and here again the user and admins could be warned of that.

Some systems can use password synchronization. Ok SSO is better, but not all systems support it, that is the reason why password synchronization can be used. When a password is successfully changed in one system, a request to set the new password is sent to another system. Under abnormal conditions (network problems) the request can be queued, or lost. In the first case, the passwords become different during a variable but short period, in the second one, the passwords go out of sync until next reset. This is seldom observed in normal conditions because you need the simultaneous occurence of 2 events: a password change and a network problem. But if a password is changed everyday on such a system, you can expect to fall in that trap.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.