3

I'm updating my company's forgot password workflow. Currently we use Duo Security as our second factor on login (but for the purposes of my question this can be any such service). I've been walking through Owasp best practices and they make sense.

My confusion comes with what I see other sites implement forgot password workflow. I tend to see side channels like SMS/Email used to send one time tokens with security questions and whatnot even if they use a service like Duo. I never for example see a site do a DUO push notification along with a security question(or other 'what you know' item).

Am I missing something obvious?

Improve this question

1 Answer 1

Reset to default
2

The attacks you mention are real problems to threat model.

I like to think email is the master key to most online accounts. SMS is arguably better, but similar risk. They let you bypass the password to login. If I can access your email, then I can get into most of your accounts.

Sites that support MFA or 2factor should still ask for your second factor after a pw reset. If they don't then they are effectively only checking a single factor - that the user can access the associated email account.

If you have seen this, it's a vulnerability in the web app and you could report the vulnerable flow to the webmaster.

Improve this answer
1
  • Small quibble - SMS is considered mediocre 2nd factor/control contact, simply because social engineering of phone number ports is so easy and common these days.
    – Monica Apologists Get Out
    Jun 6, 2018 at 13:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .