I noticed that Facebook sends out a "Forgot password" code of six digits, which is very short for a validation code, so I assume they are doing the following:
- Set a session variable which is linked to the code so no other clients can use the same code
- Possibly also, set maximum number of attempts of entering the correct code
I have two questions:
- Is the above the best way to do "Forgot password" links?
- Is an alternative not to set a session variable nor restrict attempts, but simply increase the length of the code so that brute force becomes impossible? How long would this code have to be, then? Or is this considered vastly insecure?
EDIT: The Facebook code is optionally sent to your mobile phone to be punched in manually on your computer, which must be the reason why they chose to keep it short.