We have a web app for which some users want to have a password reset function.

I don't want to enforce a particular level of security for the users. So if a user picks a strong password which she is able to remember and then proceeds to store sensitive data in our system, then we want to keep that data secure.

At the same time there is a constant stream of users who forget their password and who do not want to bother with security at all, in fact they don't even want to be asked questions about security.

How can I create a password reset function for the second group of users without reducing the security for the first group of users?

  • 1
    You could have an option on the sign-up form "allow password reset" – paj28 Aug 10 '14 at 12:54
  • As well as paj28's suggestion, you could allow reset via email without security questions. – SilverlightFox Aug 10 '14 at 13:38
  • @paj28 I suggested something like that already, but was told users must be able to get started using the app without having to answer such questions beforehand. – kasperd Aug 10 '14 at 14:28
  • @SilverlightFox That link does have good advice on how to avoid the form being used to check which usernames and email addresses are in use. I read similar advice on some of the pages I found trying to research the problem. An important question remains though, which is whether email is even an acceptable solution. There are two major problems with relying on email for this: They may be transferred in clear text. They may be rejected by over-eager spam filters. – kasperd Aug 10 '14 at 14:35
  • Maybe a text message reset.. Security questions can be bad for other reasons (eg you can't change the name of your dog as easily as a password) – SilverlightFox Aug 10 '14 at 15:03

Have a user-configurable boolean value for "reset allowed".

If you have their e-mail / some out-of-band means of communicating with the end user

When the user clicks the "I forgot my password" link, if "reset allowed" is true, send a password reset link to the e-mail account associated with the user account. Make sure you use an e-mail service that first attempts end-to-end encryption (so that, if their mail server supports that, the link never gets sent in plain. And if their server doesn't support that, they aren't denied the link).

Rate limit the number of times that e-mail can be sent to the same account (e.g. 2 resets per day) so someone can't use that to spam the account. Don't let the user know if an e-mail has been sent or if the account they mentioned even exists.

If they don't click the password reset link, nothing should change. If they click it after a certain timeout period, or if between the e-mail being sent and the time of it being clicked "reset allowed" has been set to false, nothing should happen.

If you don't have an out-of-band means of communication

If "reset allowed" is set, use a challenge-response mechanism such as user-configurable security questions. If they answer the questions correctly, allow them to enter a new password. You might also want to consider hashing the responses.

You could, of course, also use something like TOTP, but chances are if they don't have the password, they also won't have the key needed for this.

Either way

Conduct the entire exchange over an encrypted channel. Unless you're trying to stop the NSA from stealing credentials, SSL should be enough.

  • Inevitability there will be users who answer no to the "reset allowed" question and forget their password anyway. Sooner or later sales will have one of them on the phone, how can I deal with that? – kasperd Aug 10 '14 at 16:35
  • @kasperd How will the sales people know they are actually talking with that user? If the user has a good way to authenticate themselves during that conversation then that may be suitable to remove the reset allowed restriction. – PwdRsch Aug 13 '14 at 15:56
  • @PwdRsch I wish I had a good answer to that question. If I give the sales people access to remove that restriction, I am sure the customer will be able to convince the sales people, that they are the legitimate owner of the account. – kasperd Aug 13 '14 at 16:20
  • @kasperd ""reset allowed" question and forget their password anyway. Sooner or later sales will have one of them on the phone, how can I deal with that?" Well, there's no good way to deal with that; any way you slice it, someone has to be inconvenienced. I suppose the question you have to ask is whether it makes more sense to put the onus on the user or on the service provider. If they have sales on the phone, and they haven't purchased a product, and the "new account creation" option is onerous, there are a few things you can do, but none of them are fun. – Parthian Shot Aug 13 '14 at 17:50
  • @kasperd If, however, they're talking to sales and they have bought a product, then you (assumedly) have some sufficiently personal information about them which they can provide to verify their identity. Their name and credit card information or whatever they used. Although you have to be careful not to give any information away, and simply ask for it. – Parthian Shot Aug 13 '14 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.