12

If I receive an email with a plain text generated password (in response to a password reset request), is this a vulnerability? The password expires after one use, in other words the user has to change their password as soon as they register.

I could imagine that such an password reset scheme would at least be vulnerable to a man in the middle attack. The man in the middle could get the temp password and then lock out the user with a new password. But is there perhaps another vulnerability?

Improve this question
2
  • The "password" which you get for resetting accounts are actually most of the times "unique" strings. The problem may occur on how these strings are generated. For example if the string is not generated randomly enough like this $code = md5(time()); then you may be vulnerable so that the attacker can "guess" by using some bruteforce-fu.
    – HamZa
    May 15, 2013 at 22:10
  • 2
    @HamZaDzCyberDeV MD5 isn't collision resilient so you could get the same key on accident from some other input. win.tue.nl/hashclash/…
    – AbsoluteƵERØ
    May 16, 2013 at 21:06

2 Answers 2

Reset to default
10

Assuming that the password is randomly generated and not easily guessed, as you say the main way in which an attacker would compromise this system is to perform a MITM attack.

However any e-mail address based password reset system is vulnerable to the same kind of issue (e.g. one-time links) if the attacker can intercept traffic between the user and their e-mail account.

Whilst it's definitely not perfectly secure or something I would rely on for a high-risk application (like online banking) I don't see one-time passwords as a particularly poor system either.

the main recommendation would be to ensure that you access your e-mail account only over encrypted channels (e.g. SSL or IMAP(S))

Improve this answer
3
  • Good point. The one time link is just as vulnerable. It could be just as easily sniffed as the plain text password.
    – dasPing
    May 15, 2013 at 22:53
  • One-time passwords not secure enough. infosecisland.com/blogview/…
    – AbsoluteƵERØ
    May 16, 2013 at 21:38
  • 1
    @AbsoluteƵERØ reading that article, two points 1) you're mixing terms I'm talking about one time passwords in the sense that OP used it not in the sense of google authenticator, second whilst that article has a rather inflammatory title, if you read the text of it, it says that google authenticator style OTP is a lot better than any single factor solution (e.g. anything that is just username/password)
    – Rory McCune
    May 17, 2013 at 6:50
5

I don't think it's a vulnerability. When you think about it as a password sent in plaintext, then yes it's understandable to think there's a vulnerability here, but it's not a password.

Sending you a link like https://example.com/reset.php?code=97fy978y39fny39478fyn3 which is a one-time link that you click to be taken to a password reset form in which you type your new password, is essentially the same as sending you a one-time password, they just took the code from the link and called it a temporary password. The idea itself isn't vulnerable, but the incorrect implementation mostly is.

What could go wrong here?

  1. The code or the password could be very short and/or no generated with a cryptographically secure PRNG.

  2. The code or the password could give access to areas of the account for an extended period of time before setting a new password.

  3. The code or the password could stay valid for a long time, making their eventual exposure a risk.

  4. Not using HTTPS, which gives a MitM a chance to intercept them.

Update: You're correct, email is outside the scope of the implementation, but then we'd go completely off-topic. We can discuss that the whole system is broken, but there's no other option. They could send you the code in an SMS, but what if your friend was holding your mobile? They could send it to your mailbox (kind of silly) but what if somebody opened your mailbox? The only secure option left is that they send a representative of the company to go to your address and ask you for your ID and take your fingerprints (which you've given on the registration form) and then reset your password.

You see, the email is de facto way to contact the original account owner, so that's the best they can do.

All in all, I was just trying to show you that the security of the plaintext one-time password is exactly the same as the one-time link used by almost all web services (Facebook, Twitter, StackExchange, ...)

Improve this answer
4
  • You say the idea is not vulnerable, only an incorrect implementation, however one detail is outside the implementation, the email access. There is no way for the implementation to ensure that the email client is using https.
    – dasPing
    May 15, 2013 at 22:38
  • @dasPing I've responded as an update to answer.
    – Adi
    May 16, 2013 at 5:45
  • Storing the user-agent that requested the token along with it, and making sure the same UA access the link is going to improve the security at all or not? Or it's an unecessary layer?
    – jonathancardoso
    Jan 22, 2014 at 18:10
  • The idea is more vulnerable than other approaches. For one thing (as you allude to), a one-time password provides a MiTM with access to your account. A password reset link does not provide direct access to the the account. Further, the reset link can (and should) be augmented by requiring correct answers to additional security questions, plus (optionally) some form of 2FA so that the account can't be unlocked without punching in a code sent to a phone (2FA is still vulnerable to theft and cell phone cloning), and so on.
    – Craig Tullis
    Aug 16, 2015 at 18:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .