4

In an offline system what is the preferred method of resetting a user's password?

Usually this would be handled with an emailed password reset link. However this system is offline, there is no access to email.

My first thought is that an administrator would reset the password, then communicate the new password to the affected user, who would use it to log in and then be forced to enter a new password.

The shaky part of this is how should the password be communicated to the user? Presumably on a piece of paper. That doesn't seem great.

My second thought is that an administrator would simply clear the password, allowing the user to log in with no password (possibly for a limited time), and then be forced to enter a new password.

I'm not sure that's right either.

Is there some standard process for this? I'm keen to avoid some contrived roll-your-own approach.

EDIT: One point I should have clarified is that this system could have as few a one (shared) computer (managed by a group of administrators). User's won't have their own devices. The advice posted before this clarification is still useful though, so thank you.

  • What do you mean by "offline"? Is it a multi-computer networked system just not connected to the Internet? Is it a single computer? – PwdRsch Feb 21 at 7:37
  • Assume a single computer – jsh Feb 21 at 9:49
3

A temporary password is issued and communicated that must be changed upon first log on. This is very common for new employees in a company when they get their first Active Directory account.

  • To make remote communication more robust, the password may be split across multiple channels (e.g. 1/2 via SMS to a known number and 1/2 by voice after "authenticating" with business questions) – Enos D'Andrea Feb 21 at 8:01
2

To answer your questions about how the password should be communicated:

Writing the password down on paper is actually not as bad an idea as you may think. The password has to be communicated to the user in some way, and a physical paper representation at least locks the password down to people with physical access to the building. Some businesses instead communicate the passwords over email or Slack, which potentially exposes a password if anybody in the Slack chat or email chain has a compromised device, not to mention any breaches in the services themselves. Since you're not online, without access to email, paper passwords seems like a fine solution as long as they require immediate rotation.

Having an empty password is a poor idea - I assume someone on the internet is constantly trying to log in to your accounts, and if the password is ever set to something easy they'll guess it. You mentioned the system being offline, if that means that nobody can remotely log in to your service this becomes less of an issue. I would still never use an empty password as a best practice, but the attack scenario becomes much more convoluted (someone sneaks a rogue device into the building via raspberry pi or usb key malware).

Much of the general password hygiene advice you'll receive revolves around making sure your passwords are difficult to guess (complexity requirements, rotation, not setting it to a blank PW or a default PW for all new hires) and limiting their exposure (never posting them in plaintext somewhere an attacker could potentially access).

Identity and Access Management is a domain that focuses on registering users, allowing password changes/recovery, managing single signon, etc. I would look into IAM solutions as you're (rightly) keen on not rolling it yourself.

  • Even with IAM, the user needs that very first password. – schroeder Feb 20 at 20:55
  • good point, I forgot the system's offline and edited. IAM solutions can help facilitate user registration by managing and creating those first passwords. I recommend using IAM for user reg as a good way to avoid a scenario where every new hire's password is set to the same thing. – Buffalo5ix Feb 20 at 21:05
  • If paper isn't bad should I give the option of printing out the (single use) password? (Maybe this is a separate question.) – jsh Feb 21 at 10:12
  • Sure, a printed single-use password is fine, as long as you trust the physical security of your office and the passwords aren't out in the open. – Buffalo5ix Feb 21 at 17:09
2

In the simple scenario, you can do an over-the-shoulder password reset. You login to your admin account on your laptop, bring your laptop to the user, where they enter their new password into the application. The drawback of this approach is that the user can't easily use and save to their password manager to generate secure long password. A few security notes, you want to do the reset on your own machine, not the user's machine who could've installed a keylogger to snoop on your admin credentials.

There are other options if you want your user to be able to type their new password on their own device. You can have a password reset form where user can type their user id and new password, then the system will generate a ticket number. User should cite this ticket number on a phone to you. You will then tell user that for verification purpose, you will have to hang up this call and call them back, use the ticket number to lookup the user's account and a trusted phone number (which must be pre-registered on the system beforehand, not the number that the user is calling you from, nor the number the user tells you over the phone, nor the number they put in over the password reset form) and make a call back on that user's trusted number. If the person that picks up is same as the caller that's expecting you, then you have authenticated that the caller had possession of the user's registered phone number and can go ahead and approve the reset.

Alternatively, if you don't want to collect user's phone, the user can cite the ticket number to you over email and you then lookup the user's pre-registered email address, send an email to that pre-registered email address, which must contain an explanation why the user is receiving the email and a verification number, which the user have to reply back with the verification number intact and a positive acknowledgement that they want to reset. Once you received this response, you can go ahead and approve the reset.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.