0

I'm struggling with the reset password function of a web app, the way i'm inclined to do it is by sending a token based url to the email of the user and than the user can access and reset its password, but is email a trusted way to carry such sensible data ?

marked as duplicate by Xander, schroeder, RoraΖ, Community May 11 '15 at 19:12

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Well it really is a duplicated question, sorry and thanks for the quick answers. – danillosl May 11 '15 at 18:54
1

"is email a trusted way to carry such sensible data" No.

Do many websites do it? Yes.

A saving grace is to make the link one-time-use-only and require the user to choose a new password immediately. That way, if an attacker does intercept the email and use it to hijack the account, when the legitimate user clicks on the link later, they will get an error message and know that something is wrong. As mentioned by @Xander, this is far from ideal, but at least it's something.


If you want better security, think about adding a second factor to the password reset tool, like sending a code to the user's SMS, or "where was your mother born?" type security questions, or any of the other standard second factor methods (should be able to get a good list by Google).

Not the answer you're looking for? Browse other questions tagged or ask your own question.