Need your suggestion on this.
Consider We have a mobile application and massive number of users. We want to implement secure password reset functionality with the consent of user experience.
Assumption - Here we all assume that hacker has stolen the phone of victim hence traditional password reset implementation will certainly not work as:
- If We send password reset OTP on phone, hacker has victim's phone already. Hence no use.
- If We send password reset token, hacker has victim's phone where in majority case email id is linked and opened in the phone. Hence no use.
Current implementation - If someone requests password reset request, we give them new password after 24 hours. We keep this time window so that if user's phone is stolen and hacker sends password reset request, then user must be able to report us within 24 hours so that hacker does not do any malicious activity from his/her account.
Problem - We need to reconstruct this implementation by assuming two thing in advance that user's phone is stolen and hacker has sent reset password request to us and user has not reported us that his/her phone is stolen in 24 hours. How can we identify achieve this task without identifying that the user is legitimate or not and still user's account remain secure?
Couple of Solutions:
- We start providing hardware tokens (RSA token, VASCO token) to our users so that even if phone gets stolen, to reset and use new password hacker will have to physically access these tokens to login. (Problem - It is impossible for us to provide 500000 of hardware tokens for our users.
- Trusted numbers - While registering, user adds two trusted number which is stored in our database. With the reset password request, we provide password in two separation on those trusted numbers and user can access application by combining those. (Problem - User experience becomes tricky and unacceptable)
- While registering we provide some security questions( not traditional questions of birth date, mother's maiden name etc.) such as select 1 out of 4 colours. Select 1 out of 5 food etc. While reset password we provide them these questions to answer as hacker wont be knowing these all. (Problem - If I register now and I forget pin after 1 year, I wont be remembering these answers, only case in which I remember these answers is if I took a screenshot of those answer while registering it which is again a concern in stolen phone)
- Backup code - We provide backup code unlike google while registering and user will have to add those in order to reset password. (Problem - Most of the cases, user takes screenshot of backup codes or stores in notes application which is again a concern in stolen phone)
Apart from these, We need other suggestions through which we can implement some solid solution and still user experience tries to remain smooth.
We completely agree that security and user complexity are inversely propositional. If we want to implement bulletproof security, user experience will go bad. However I want answers from the community if there is a way we can do it.
Suggestions are appreciated.