5

I am working with another UX guy and he's let me know that there have been some studies surrounding the fact that when a person goes through a "forgot username/email" process, they enter in extra information and that this extra information should be enough for a user to be logged in without having to enter a password.

In our case, the user has two options - either enter their phone number, last name and DOB then receive a text message (or call) to confirm; OR they can enter social security number, last name and DOB.

Then the next step is to answer their security question (1/3 questions). If they answer this question correctly, they move on to a logged in state in their account. No password necessary.

Is this common practice these days? Is this still relevant for a financial company? Can a user just keep doing this as another option to log in?

I have a feeling that all of the information needed to log in can be found in the user's email. Assume their email address has been hacked... We require the same information for forgot password as well, though the password is something that users inherently make secret. Everything else can be found fairly publicly, unless they don't answer the security questions properly on purpose (like I do)

EDIT: My suggestion: I believe to retrieve information, a person should have something that only they know (not written on paper ANYWHERE), security information (assuming they used it to sign up [SSN, DOB]) and a piece of physical information (In this case, a debit/credit card number that they physically possess). This seems like the most secure way to get into an account. thoughts?

3

No, don't make password reset based on anything submitted in a form. You need to determine the users identity through a method besides your own website. Either via two factor authentication (usually phone) or via a known email address. The danger here is brute forcing, guessing, or stealing the data needed for a password reset. Yes, it is often quite possible to maliciously aquire a user's ssn, dob, and phone number. Stealing their phone or compromising their email is often far, far harder. Also, be very careful about storing or asking for the users ssn - this can be treacherous, especially if an attacker manages a man in the middle or sql injection attack.

Stick with e-mail Auth or two factor Auth for password resets.

  • Thank you for that info. Unfortunately, I'm looking for username resets. It's a bit trickier in this case. The security we have on SSN and DOB are stellar and aren't really in question at this point, it's really the best way to have someone recover an account without knowing the best method of contact. I'll take a look into two factor authorization for this anyways. – ntgCleaner Apr 7 '15 at 18:07
  • @ntgCleaner It's actually very unwise to use the SSN for username retrieval. It allows for targeted hackers to steal someones SSN. Contact me for more information on this. Read this: linkedin.com/pulse/… – Tim Martens May 27 '15 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.