Modes of Attack on Time-Bombed Password

Question

I'm one of the co-founders of plaintextoffenders.com. We recently received a submission for which I'm not sure if there is a means of attack or not. The site in question is a hosting/VPS/etc. company.

Once someone clicks on Forgot Password, an email is sent to the user's email address. It specifies a password reset address (good) which is time-limited to 15 minutes (excellent) but also contains the user's temporary password for those 15 minutes (huh?).

While this is clearly not an indication that they are storing passwords in plain-text, it got me thinking whether sending the temporary password, along with the time-limited reset link, had any security implications.

Update: After reading your answers and going through the wording of the email carefully, I've found that the password supplied is not the temporary post-reset password, but the password that will be used permanently after the reset link has been clicked. This fits in with our mandate and the post will be published. Thank you all for your answers!

Answer 1

A "password reset address" is a temporary password -- and one that can be leveraged into a permanent password. A "password" is a piece of information that a user can present to be granted access. The "password reset address" fits that definition.

So I would say that the particular bridge of "password over email" has been crossed already. The inherent risk of such sending is mitigated by making the address applicability limited in time -- just like the "temporary password".

One could argue that the "temporary password" is a bit more risky in the following sense: if an attacker eavesdrop on the email, he can use both the password reset address and the temporary password, but using the temporary password leaves fewer traces, whereas actually resetting the password will be easily spotted by the rightful owner, on account of him not being able to log on any more. The difference is slight, though. I would say that the "temporary password" feature is quite useless but not significantly more risky than the password reset address itself.

(I suppose that the "temporary password" is for people who need access fast but don't want to break their own, cumbersome, slow password renewal policy. An edge case to help people who happen to dig their own grave.)

Answer 2

My gut feeling is that there is probably little to no risk; assuming that the application correctly verifies that the particular password is only valid for 15 minutes.

As most hacking attempts aren't targeted, it is very unlikely that if the password somehow falls into the hands of an attacker, he will be able to exploit it within the very small window of opportunity.

However, there still isn't a point in sending the password along with a password reset URL. It is still better to remove it.

It all comes down to the profile of the website. If it's a banking or highly confidential web application, don't do it. There might be attackers planning targeted attacks against your users. For most web applications though, I don't see much of a risk.

Answer 3

The main advantage I could see here is that it (kind of) helps prevent attacks on the reset links. If a short link token is used, in theory someone could just keep guessing links.

Breaking it up in to multiple pieces that require a username, password sent via e-mail and link sent via e-mail IS more secure than simply a link of the same length since it protects further against people just trying to guess password reset links, but just as much security could be obtained by simply using a longer token in the password reset link. Might be some technical limitation to the system that prevents a longer token though. Either you need username + reset link token + temp password or you need username + longer reset link token. The sum total entropy is all that matters since e-mail leak is equally problematic for either.

Answer 4

To, so clarify, requesting a PW reset from this site will immediately do so (hence a temp password; the reset link should bypass login credentials because that's the point) but then has a time-limited reset link that will allow them to specify a new one?

So what happens if the time-bombed link and password expire? Is the user account locked down until the user responds to a subsequent reset e-mail in time? I could see that being a playground for a script kiddie feeding in as many e-mail addresses as he can find (and for sites which cater to corporate customers, using corporate e-mail addys of the form first.last@corpdomain.com, all you would need is the e-mail domain and a company phone list to shut down an entire company's access to this third-party site).

Obviously, the password-reset-over-email system provides two-factor authentication which is typically a good thing. The fact that the temp password is transmitted in more or less plain text is worrisome, but your attack vector in that case is someone sniffing the email server's network traffic, which is a couple of levels of sophistication above the average script kiddie or spambot.

The entire scheme, of course, is weak against an attacker who can crack the e-mail account password; if he's gained access to the GMail account you used to register with the site, he can reset both passwords and you're SOL, but that's true of any reset-by-email scheme, and it's still better than using publicly-available "secrets" like your mother's maiden name, your high school, or other easy-to-research security questions.

Answer 5

The weakness I see is that there is a potential for defeating the goal of the system if the user's old password does not get locked out.

If you are sending an email to someone letting them reset the password without knowing the current one (the typical "forgot the password" case), anyone who has compromised the email account can take control of the password protected system. This is a natural part of the compromise provided by "forgot the password" systems.

However, one important thing about this process is that, even if the attacker does have the email system compromised, they cannot attack the password protected system, and leave undetected. They always had to change the password, which is a small but detectable amount of change.

If the system allows you to use the temporary password, but after 15 minutes it lapses back to the original password, then the system is less strong. Now the attacker can use the temporary password for 15 minutes, delete the email, and the victim is none the wiser. However, if the system disables the original password immediately when you send the "forgot the password" message, it is safe. Likewise, it is also safe if that temporary password can only be used to change the password, not to access the site.