Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it only requires an attacker to gain access to a users email account to compromise his online account. It circumvents every other security measure such as password requirements, 2FA and so on.
Is it acceptable not to offer a Forgot My Password feature when security is a big concern?
It circumvents every other security measure such as ... 2FA
It doesn't and anywhere that it seems to doesn't have 2FA. Any site with an even half-decent 2FA implementation - even the weak SMS-based approaches - should require you to provide the second factor when resetting the password, or at least not log you in (after resetting) until you provide the second factor. This is a basic minimal requirement for any system that claims to use 2FA: there is no flow ending in an authenticated state where the user didn't supply two factors.
OTOH, lots of sites still don't support 2FA, while all the major webmail systems do (and some non-webmail, though mostly those are corporate ones). Your email account should be one of the most secure you have (because it's usable as an authentication factor everywhere that has a "Forgot Password" or "Magic Link" option). Of course, people are bad at security (e.g. some of them try to call things 2FA when they allow logging in using only the single factor of an email account...) but as a user, you can and should ensure that your email account is one of your most secure accounts.
As for abandoning "Forgot Password?" flows, people forget their passwords constantly. If you do this, people will either just not use your site, bombard your support staff with requests for help logging in, or use extremely weak and reliably guessable passwords (similar to what happens when you force people to change their password periodically). None of that is good (well, not for you, at least).
I'm not sure that this is a security question, but there are lots of cases where there is no automatic, self-service password reset function. Staff accounts at companies, bank customer accounts, etc.
So, from a security standpoint, as long as you have a process for users to recover their password that is strong enough to mitigate the risks of a compromised account (proper identification checking, etc.), then that is actually quite normal.
When talking about security, the three main areas that are considered are Confidentiality, Integrity and Availability (known as the CIA model).
A weak password recovery mechanism can compromise the confidentiality and integrity of data held in your application. However, the absence of the functionality can also have a serious availability impact.
Imagine you have an online-only bank account (where security is a big concern), and you forget your password. If there's no way for you to recover it and regain access to you account, you've just lost all the money stored in that account - which is exactly the same real-world impact as someone compromising your account and stealing the money.
There are certainly strong arguments against the usual password recovery emails, or even more secure self-service implementations. But then if your process involves the user phoning up and answering a few security questions (which are notoriously weak) then that's not much of an improvement.
There are also cases that have no recovery option (such as the private keys for a bitcoin wallet) - but they're generally not acceptable for use by the general public - because people are prone to forgetting passwords.
Some services are migrating to passwordless authentication, instead choosing a single-factor system (like using a 2FA app or securely messaging you a code or login link).
This removes the "forgot my password" backdoor but does add an equivalent "lost my phone" backdoor. I expect login recovery would be rarer in this scenario and therefore a threat assessment can be a little more aggressive against it.
Some sites use emailed links for logins exclusively, effectively logging in the same way password recovery works (shifting the risk of a pw change locking out the true owner to an email change locking out the true owner).
