Which is harder to exploit: Password reset link with tokens/timestamps/code/ticket etc Or, temporary password sent on user mail using which login can be done and password can be changed.
Any suggestions on how they can be exploited please?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityWhich is harder to exploit: Password reset link with tokens/timestamps/code/ticket etc Or, temporary password sent on user mail using which login can be done and password can be changed.
Any suggestions on how they can be exploited please?
I an not sure how to directly exploit the Password reset links but the link pattern can be definitely used for Phishing campaigns. However for temporary passwords I feel that their strength depends on how guessable they are and how strong the password generating algorithm is. If they are random like OTP, there might be issue of randomness.
Receiving a plain text password (That the user must change upon login) and receive a link with a token it's the same, as long as they meet security policies that are not attached to any type by its own. Some good policies are:
Which is harder? TLDR; Password recovery links.
There are a lot of nuances with account recovery processes. This is why they are problematic to implement effectively.
First, sending temporary passwords usually overwrites the user’s existing password, locking them out. As mentioned in here, it’s a form of Denial of Service. Also, systems don’t always force you to change the temporary password. This is convenient for users, to store their passwords in their mailbox. It has also inadvertently caused a bad habit to be passed on.
Password reset links are preferred as they do not lock the account out, are time limited, and have a random element that is not easily brute forced, and expire after being used.
As I mentioned, there are obviously nuances to consider, but can be distracting.
In most cases, MFA usually comes to the rescue, even when an attacker knows your password, it is even more difficult to gain access.
(MFA also has weaknesses, like prompt fatigue, SIM takeover, etc, but that’s for another day)
Exploit paths
Assuming you mean account takeover. Examples provided are illustrative and not comprehensive:
Temporary password:
Password reset link: