My webapp has "password reset" and "password change" functionality.
Password "reset" is typical: user clicks "I forgot my password", enters his email, one-time link emailed there, he visits a form to choose a new password.
Password "change" is more complicated. There are two approaches:
- Some sites use a one-step process: user logs in, clicks "change password", enters old password, chooses new password.
- Other sites use a two-step process with an email loop: user logs in (HTTPS), clicks "change password", link mailed to his email, he visits a form that asks for a new password. His current password is not requested. This is done (possibly) without even logging in!
These two are very similar, but there are tradeoffs.
Option (1) is simpler. BUT, if the user's device is stolen (or let's say he just steps away from his desk for some coffee), and he uses a browser with a password manager, then the attacker doesn't need to know the password.
Option (2) doesn't even ask for his current password, because it verifies him via email. BUT, if the attacker has his device, then he probably has access to the email anyway. And if I ask for the current password, and a password manager is installed, then the email loop accomplishes nothing anyway.
Also the "reset" workflow is so easy to use, that if I over-engineer the "change" workflow then the user (and an attacker) could use the reset form instead.
So it seems to me that this is not a security problem, but an UX problem only. The two-step "feels" more secure, but I think that is an illusion.
Which is better for security (rather than UX)? Are there considerations I've neglected?