3

I am creating a web application for individual accounts. The email address is also used as the user name. 2FA is setup for the user to optionally use. I've been trying to wrap my head around preparing for account recovery in these couple of scenarios:

  • A user hasn't logged in the website in a while and no longer has access to their email account, and they also forgot their password.

  • A user's email is breached, and the hacker/bad actor comes across some emails related to the website. Worst case scenario, they go to the website and reset the password using the forgot password feature, and then change the email address.

For the first scenario, if a user no longer has access to the email or maybe doesn't even know the email they used, how can I properly authenticate that they are who they say they are? I'm currently tracking a history of email changes, and the last three password hashes used.

For the second scenario, here is the approach I am considering, but not sure of:

  • Anytime a password or email is changed for the first time in the last 24hrs (using 24hrs as an example), store the original Email(Username) and password hash with a timestamp in a database table.
  • If the email or password is changed again and the 24hrs isn't up yet, the original stored email and password will remain.
  • Send an email anytime the password is changed, reminding user if they don't recognize this change to immediately use the password reset feature and reset their password.
  • When an email is changed successfully, send an alert to the original email notifying of the change. Also, allow the user to recover their account using their last know login credentials within 24hrs if they do not recognize this change. This is where the stored email and pw hash will be used as long as the user attempts recovery within 24hrs. So even if the hacker managed to change the email and password, the original user could still recover their account (within 24hrs) and gain control back.

I would like to add, the site is still in development and has no users, so I am trying to sort this out early on. I also don't have much of a budget currently, so using SMS verification isn't something I can use unfortunately to start out with.

2
  • The fact that you happen to use .NET seems entirely irrelevant for the question. I've removed this information.
    – Ja1024
    Commented Mar 31 at 5:27
  • @Ja1024 That's fine. I added the Framework in case it helped someone suggest something already supported or off-the-shelf I wasn't considering.
    – eaglei22
    Commented Mar 31 at 16:36

1 Answer 1

2

If you want users to be able to recover their account when they no longer have access to their e-mail address and forgot their password, you can introduce alternative authentication methods like the following:

  • a recovery passphrase consisting of actual words which may be easier to remember than the original password chosen by the user
  • a randomly generated token which the user is supposed to download or print out and store somewhere safe
  • a backup file containing random or encrypted data which can be uploaded to regain access to an account

Of course all of this only makes sense if the user takes account recovery seriously and keeps the data both safe and accessible. You should include detailed instructions on why the data is important and what the user is supposed to do with it. Additionally, you should recommend the use of a password manager. This not only solves the underlying problem (forgetting passwords), but it's crucial for generating and safely storing strong passwords.

As to the second scenario (recovering from a breach of the e-mail account), I strongly recommend against interfering with e-mail or password changes. If the system automatically restores a previous e-mail address or password, this may help against changes caused by an attacker. But it might as well sabotage a legitimate user who wants to do those changes to protect the account from an e-mail account they've lost control over or a password that has been leaked. In other words, you cannot assume that the old credentials are still valid and the new ones possibly attacker-controlled -- it might be the other way round.

Use a straightforward procedure without any loopholes.

  • If the user wants to change their e-mail address and can authenticate with their password, you should accept that and not give the owner of the previous address any veto rights. The old e-mail address address may be controlled by somebody else now. At most, send an informational mail to the previous address.
  • If the user wants to change their password and can show control of the e-mail address (by clicking on a I-forgot-my-password link), you should also accept that and not allow the use of the previous password which may be compromised now.
  • If the user has lost both access to the e-mail address and forgot their password, or if the account has been taken over by an attacker, then the recovery methods mentioned above (passphrase, random token etc.) could be used to regain control.
3
  • Great, thanks for the helpful advice! I will look into each of the bulleted alternate authentication methods you suggested in more detail and go from there. To follow up, what about in the event a user just comes with nothing? Maybe they forgot or lost where they stored the downloaded token, etc. At this point is it better to just tell them there is nothing that can be done, and to create a new account? Or can they send me an image of some kind of identification, that matches their stored user attributes. Eventually when I am able to add SMS verification, I can use that as part of theprocess
    – eaglei22
    Commented Mar 31 at 16:28
  • 1
    If you allow somebody to completely circumvent the authentication procedure and instead present some image as proof of ownership, there's a huge risk this will be abused for attacks. Images can be faked. It's better to accept the fact that sometimes accounts are lost. This shouldn't be catastrophic.
    – Ja1024
    Commented Mar 31 at 16:52
  • Okay, appreciate your time and help answering my questions. Thank you!
    – eaglei22
    Commented Mar 31 at 16:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .