2

I have recently been considering the password reset flow for a site I'm working on. A request came up that before authentication, a user should have an option to change their password by providing:

  • Username
  • Current Password
  • New Password (matching complexity requirements)
  • Confirm New Password

Ignoring user experience for the moment, is there anything insecure about this flow IF:

  • An identical generic error message is displayed if any of the fields above are invalid on submission
  • Password lockouts are enforced after valid username and invalid password are submitted X times.

Is this any more or less secure than the login page itself, and therefore, no additional risk?

||improve this question
  • 2
    Just a site note, I would not call this password reset, this is more a password change flow. Password reset usually involves setting a password after loss or by admin interaction. Having said that, the usecase to describe is rather common for changing the initial password (with an additional step and the fact you are typically logged in afterwards) – eckes Feb 22 '19 at 18:38
  • 2
    As someone who had to reset a lot o password recently, please, please, don't call this feature a password reset, thanks :) – Felipe Pereira Feb 22 '19 at 19:42
  • Haha fair enough :) – Frostbyte Feb 22 '19 at 19:52
  • Lockout after X times potentially enables user enumeration. Of course if an a rejected-due-to-lockout outcome is indistinguishable from a rejected-due-to-any-invalid-field outcome then that's not an issue. So if you don't want that then you need your lockout error message to also be identical to your invalid-field error message. (And close any side channels. Timing attacks, for example. You don't want the web server's response time dependent on whether or not an account exists.) – Future Security Feb 23 '19 at 4:46
2

I can't think of any additional attack surface that this user flow would be exposed to. The messiest part is if 2FA is ever enabled for your site you'd have to make this password reset flow multistep as well.

You're not changing the required information to submit a password change or the order of operations to achieve one, so if this page as secured as your normal login page there's no problem with it.

||improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.