We're using a CMS that has a password reset function that works according to best practices out of the box.
- Passwords are stored as salted hashes
- Forgot Password works like this:
- User enters either username or email address in textbox
- System generates an email with a "reset password" link
- User has x amount of minutes to follow the link and reset the password, or it's disabled.
(Side note, we would like to add two-factor authentication, and the company that develops this CMS is working on providing that, but as of yet it's not available.)
Optionally, we can include the username in the email in case the user has forgotten their username.
Does including the username in the password reset email result in an added security risk?
Clearly it's one more piece of information an attacker has their hands on, but truth be told, if an attacker manages to intercept this email they can already just click the first link to log in as the user, so I don't really see an added risk. Am I missing anything?