How to reset passwords without emailed reset link?

Question

In an offline system what is the preferred method of resetting a user's password?

Usually this would be handled with an emailed password reset link. However this system is offline, there is no access to email.

My first thought is that an administrator would reset the password, then communicate the new password to the affected user, who would use it to log in and then be forced to enter a new password.

The shaky part of this is how should the password be communicated to the user? Presumably on a piece of paper. That doesn't seem great.

My second thought is that an administrator would simply clear the password, allowing the user to log in with no password (possibly for a limited time), and then be forced to enter a new password.

I'm not sure that's right either.

Is there some standard process for this? I'm keen to avoid some contrived roll-your-own approach.

EDIT: One point I should have clarified is that this system could have as few a one (shared) computer (managed by a group of administrators). User's won't have their own devices. The advice posted before this clarification is still useful though, so thank you.

Answer 1

A temporary password is issued and communicated that must be changed upon first log on. This is very common for new employees in a company when they get their first Active Directory account.

Answer 2

To answer your questions about how the password should be communicated:

Writing the password down on paper is actually not as bad an idea as you may think. The password has to be communicated to the user in some way, and a physical paper representation at least locks the password down to people with physical access to the building. Some businesses instead communicate the passwords over email or Slack, which potentially exposes a password if anybody in the Slack chat or email chain has a compromised device, not to mention any breaches in the services themselves. Since you're not online, without access to email, paper passwords seems like a fine solution as long as they require immediate rotation.

Having an empty password is a poor idea - I assume someone on the internet is constantly trying to log in to your accounts, and if the password is ever set to something easy they'll guess it. You mentioned the system being offline, if that means that nobody can remotely log in to your service this becomes less of an issue. I would still never use an empty password as a best practice, but the attack scenario becomes much more convoluted (someone sneaks a rogue device into the building via raspberry pi or usb key malware).

Much of the general password hygiene advice you'll receive revolves around making sure your passwords are difficult to guess (complexity requirements, rotation, not setting it to a blank PW or a default PW for all new hires) and limiting their exposure (never posting them in plaintext somewhere an attacker could potentially access).

Identity and Access Management is a domain that focuses on registering users, allowing password changes/recovery, managing single signon, etc. I would look into IAM solutions as you're (rightly) keen on not rolling it yourself.

Answer 3

In the simple scenario, you can do an over-the-shoulder password reset. You login to your admin account on your laptop, bring your laptop to the user, where they enter their new password into the application. The drawback of this approach is that the user can't easily use and save to their password manager to generate secure long password. A few security notes, you want to do the reset on your own machine, not the user's machine who could've installed a keylogger to snoop on your admin credentials.

There are other options if you want your user to be able to type their new password on their own device. You can have a password reset form where user can type their user id and new password, then the system will generate a ticket number. User should cite this ticket number on a phone to you. You will then tell user that for verification purpose, you will have to hang up this call and call them back, use the ticket number to lookup the user's account and a trusted phone number (which must be pre-registered on the system beforehand, not the number that the user is calling you from, nor the number the user tells you over the phone, nor the number they put in over the password reset form) and make a call back on that user's trusted number. If the person that picks up is same as the caller that's expecting you, then you have authenticated that the caller had possession of the user's registered phone number and can go ahead and approve the reset.

Alternatively, if you don't want to collect user's phone, the user can cite the ticket number to you over email and you then lookup the user's pre-registered email address, send an email to that pre-registered email address, which must contain an explanation why the user is receiving the email and a verification number, which the user have to reply back with the verification number intact and a positive acknowledgement that they want to reset. Once you received this response, you can go ahead and approve the reset.