Password reset question answer complexity

Question

I need to implement a password reset feature for a system that will be controlled by a security question and answer pair. The problem is that I can't guarantee I'll have a valid e-mail address or cell number for the account that I can use to communicate a reset link or code. This means the entire process will happen on the web page. I will have a known e-mail address for the user, but it's an address that was issued by the system in the first place, meaning the fact that someone is using this feature at all may imply they no longer have access to that account.

In this circumstance, it seems like the security answer effectively becomes an alternative password, in that knowing the Question (I plan on requiring you to select the correct question from a list, as well) and Answer for an account are the same as knowing the password. This makes me think that you'd need to have the same kind of complexity requirements for the security answer that you do for a password. However, I can't recall ever seeing this implemented. If I've run into requirements at all, it's usually something simple, like at least 3 characters just to make sure you put something verifiable into the field. They're also relying on the fact that send the code to a registered location in place of the additional complexity.

I plan to mitigate this by also sending an e-mail on completion, or when the session expires on failure, and by limiting the number of attempts in a given time frame. The system administrator has the ability to do a reset manually, without knowing the question/answer or original password, so I can't lose control of the account. But it seems like I'm still missing something. How should I handle this?

Answer 1

In this circumstance, it seems like the security answer effectively becomes an alternative password

That's right. Which is also why this seems like a really bad idea. It will only work as a feature if the question is something simple, something the user will know without having to remember it, which means that an attacker can figure it out as well (by searching for info online, on facebook, asking the victim, etc).

Your current idea would weaken the security of your user accounts considerably, so I would look for an alternative. The best way would be to require an alternate email address or phone number (such as most email providers such as google do).

Another alternative (if you require real names for sign-up) would be to require something like the copy of an identifying document for password recovery. An attacker might still be able to get this (especially if they know their victim personally), but it would be a bit more complicated.

If you want to stick with your concept, at the very least I would perform password resets via phone instead of online, to deter some attackers.

Answer 2

I would not recommend doing what you are trying to do. As you pointed out, the question/answer is much less secure than a normal user/pass, and security is only as effective as the weakest link, and obviously this sort of implementation is the weak link. Also, as an aside, it may be difficult to remember which security question was originally selected.

Your problem is exactly as you stated:

The problem is that I can't guarantee I'll have a valid e-mail address or cell number for the account that I can use to communicate a reset link or code.

I would suggest you ask why not? What can you do so that you guarantee it? There are some (very popular) websites that give you the option of associating an email address with your account. If you do, you can reset your password. If you don't and you forget your password- then you're SOL, and you must create a new account. I would consider that approach over reducing the security of everyone just so some people who choose not to submit a valid email can reset their password.

Answer 3

Do not try to reinvent the wheel. Do not sacrifice security for usability

The existing password resetting schemes are already tested and validated against access control threats. They are not perfect but they are accepted.

The approach you propose to reset the password is very weak.

Think about that I am an attacker. I do not need to go after the account and try expensive brute force or dictionary attack. I need just to claim that I forgot my password then I will be directed to the security questions page where I have a list of all possible valid questions I can try each one of them. The answer is most likely a dictionary word or phrase or at least human readable. Moreover, I know a bit of social engineering it is happen that the account I am trying to attack I know the legitimate owner of the account. The chance that I will break into the account is very high.