Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I need to implement a reset password feature with Multifactor authorization. The plan is to use these 2 factors: ask a security qs and email/sms a code to the user.
I think the order of these should be: answer qs---> send code ---> create new password. But our current wireframe has: send code --> answer the qs ---> create new password.
Thoughts?
Your idea of changing the order is good, because the additional question could be used to avoid sending unnecessary password reset messages just by typing in the username or the email address. The security question is not there because it's secure: their nature tend to be easy to answer after researching the target. That's why the order matters for other reasons.
If you use email addresses as login names, they are bind together in a way that makes it easy to know where the information needed to reset the password goes. That's not generally dangerous to every user, but on a large pool of users there may be someone who's vulnerable. Also, if the email gets compromized first, it may be used for resetting passwords for such sites. In this case, two factors isn't much.
There's all kind of variations, but the factors should always be independent: something you must know and something you need to have access to. Using both email and SMS adds extra level of security, e.g.
Nowadays it's common that people have their email on their phone. Having unlimited access to someones phone gives ultimate power over two of these factors: email & SMS. That's why security questios aren't completely pointless even if they don't add a strong layer of security. The phase 1 possibly prevents an unlocked stolen phone from being used for a password reset.
