They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it only requires an attacker to gain access to a users email account to compromise his online account. It circumvents every other security measure such as password requirements, 2FA and so on.

Is it acceptable not to offer a Forgot My Password feature when security is a big concern?

  • 4
    "acceptable" to whom?
    – schroeder
    Aug 31, 2021 at 15:48
  • I think that if someone has the ability to gain access to the associated email account, they can also get access directly to the interested account using similar techniques. Behind Gmail there are a lot of programmers, so I think that is more secure than a new system. A password reset combined with a (mandatory) two factor authentication is pretty sure (you could also require additional info like an identity card) and this functionality is vital in a lot of websites, so I would implement it. Sep 1, 2021 at 19:56

4 Answers 4


It circumvents every other security measure such as ... 2FA

It doesn't and anywhere that it seems to doesn't have 2FA. Any site with an even half-decent 2FA implementation - even the weak SMS-based approaches - should require you to provide the second factor when resetting the password, or at least not log you in (after resetting) until you provide the second factor. This is a basic minimal requirement for any system that claims to use 2FA: there is no flow ending in an authenticated state where the user didn't supply two factors.

OTOH, lots of sites still don't support 2FA, while all the major webmail systems do (and some non-webmail, though mostly those are corporate ones). Your email account should be one of the most secure you have (because it's usable as an authentication factor everywhere that has a "Forgot Password" or "Magic Link" option). Of course, people are bad at security (e.g. some of them try to call things 2FA when they allow logging in using only the single factor of an email account...) but as a user, you can and should ensure that your email account is one of your most secure accounts.

As for abandoning "Forgot Password?" flows, people forget their passwords constantly. If you do this, people will either just not use your site, bombard your support staff with requests for help logging in, or use extremely weak and reliably guessable passwords (similar to what happens when you force people to change their password periodically). None of that is good (well, not for you, at least).

  • Thanks for your reply. The problem is although we support 2FA. we don't make it mandatory for a user to use it. Do you suggest we enforce 2FA (i.e, account is not setup until the user activates 2FA?) Thanks! Sep 1, 2021 at 20:57
  • That's a decision that depends on your product's security needs, and I can't really advise on that here. There are definitely products which should require it, though. More to the point, however, if the user has 2FA enabled, you must respect that by never allowing anybody to log into that account without two valid, separate factors. Emailed secrets (in the form of magic links, password reset codes, or one-time passwords) are only one factor. If you allow a "Forgot password" flow to bypass what you call 2FA, then you don't actually have 2FA at all.
    – CBHacking
    Sep 1, 2021 at 21:40

I'm not sure that this is a security question, but there are lots of cases where there is no automatic, self-service password reset function. Staff accounts at companies, bank customer accounts, etc.

So, from a security standpoint, as long as you have a process for users to recover their password that is strong enough to mitigate the risks of a compromised account (proper identification checking, etc.), then that is actually quite normal.


When talking about security, the three main areas that are considered are Confidentiality, Integrity and Availability (known as the CIA model).

A weak password recovery mechanism can compromise the confidentiality and integrity of data held in your application. However, the absence of the functionality can also have a serious availability impact.

Imagine you have an online-only bank account (where security is a big concern), and you forget your password. If there's no way for you to recover it and regain access to you account, you've just lost all the money stored in that account - which is exactly the same real-world impact as someone compromising your account and stealing the money.

There are certainly strong arguments against the usual password recovery emails, or even more secure self-service implementations. But then if your process involves the user phoning up and answering a few security questions (which are notoriously weak) then that's not much of an improvement.

There are also cases that have no recovery option (such as the private keys for a bitcoin wallet) - but they're generally not acceptable for use by the general public - because people are prone to forgetting passwords.


Some services are migrating to passwordless authentication, instead choosing a single-factor system (like using a 2FA app or securely messaging you a code or login link).

This removes the "forgot my password" backdoor but does add an equivalent "lost my phone" backdoor. I expect login recovery would be rarer in this scenario and therefore a threat assessment can be a little more aggressive against it.

Some sites use emailed links for logins exclusively, effectively logging in the same way password recovery works (shifting the risk of a pw change locking out the true owner to an email change locking out the true owner).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .