0

The library of the Technical University in my city (Europe) has a password reset system which I did not encounter anywhere else.

Students have to go to some office inside the university to get a new password; external users (like me) have to write an e-mail to an e-mail address of the library. I did this and a few days later received an e-mail (seemingly from a real person) saying:

Your password is now reset to be your birthday, in the form YYYYMMDD.

There is an online form where one can change their password.

This method seems strange to me: I'm used to filling out an online form and then receive an automatic e-mail with a link to change my password. This method here seemed a hassle both for me and the library personnel.

Is there a practical reason for this kind of method? Is it especially safe? To me, it does not seem so but I don't know anything about Information Security.

I received two good answers (one of which disappeared), so I want to thank you all!

3

In no way is this safe and in no way is this the result of "security processes".

It looks like they have no password reset process and that it is all done by hand.

  • Thank you for your answer! Is it more difficult to create a Password reset form than a Password change form? – user182259 Jul 16 '18 at 15:19
  • it all depends on the capabilities of the underlying system – schroeder Jul 16 '18 at 16:19
  • A password reset form for that particular account should be authorised by a random string that is only valid for X hours. You see this quite often with websites using PHP. Personally, this is the better way, it's not particularly difficult to obtain your full birth of date. Despite how accessible it can be via social media, let alone social engineering. This is why 2FA should also be enabled. As password resets are a vulnerability. – safesploit Jul 16 '18 at 16:56
  • 3
    @safesploit and knowing that the password is always set to the birthdate means that an attacker can trigger the reset then log in without ever having access to the victim's email account. – schroeder Jul 16 '18 at 17:04
  • @safesploit: I don't understand your comment at all, but thank you anyway. It's strange for a technical university to do this by hand, I would believe. – user182259 Jul 17 '18 at 7:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy