I am currently in the process of designing a registration form for the users to register accounts. The accounts will contain a lot of personal information, so I want to ensure highest possible security. The biggest flaw/problem in the requirement is that username must be first letter of the user followed by his last name, and thereby finding username is an easy task. Due to that I ensure to enforce minimum 12 character passwords that include numbers and capital and lower case letters.
However I was wondering if a user goes on vacation or has a child or takes some long leave and then comes back not remembering the password. What means would there be for him to retrieve/reset his password?
I found issues in any approach I can think of.
Asking security questions doesn't seem like a good choice, since that seems to defeat the purpose of enforcing long passwords. Nowadays many people are not too smart and therefore answers to many security questions can be found easily online by doing some research.
Simply sending reset link or new temporary password to the user's email without doing some authentication also seems pointless because what if the user has a very weak password on their email then the attacker will just try cracking their email instead of their account.
And pretty much any other reset/retrieve password means I can think of seems to defeat the purpose of ensuring a user has long password.
What authentication/reset method would you recommend for this?
Any help will be greatly appreciated.