In most, if not all, web forms for logging into a site, you have your forgot password link. When clicking the link, you get a new form (usually in a new page) either empty (!) or prefilled with the email address you put in the login form, where you have to click again to actually get the site to send the reset password link.

I think what should happen is that when clicking over the forgot password link, a reset password link is automatically sent. Then the link text changes to "Reset password link sent to xx@yy.zz" until you enter again a wrong password.

Is this worse in any way than the standard procedure, security-wise?

PS: The UX side of the question's here.

PS2: I'm thinking about sites where your username is your email address (of which there are aplenty), otherwise BadSkillz's answer points to a very valid information leak risk which could be mitigated via changing the message.

  • Is this worse in any way than the standard procedure, security-wise?: what is this standard procedure you are comparing with?
    – user45139
    Aug 20 '15 at 10:11
  • First paragraph describes the standard procedure. Second paragraph suggests my improvement, @begueradj
    – Vinko Vrsalovic
    Aug 20 '15 at 10:30

This makes (somewhat) sure that you really are the user associated with the account, you should at least know what email address was used to create the account.

Filling the email address automatically could already give an attacker the opportunity to get all the email addresses in the database, just request a new password for every account you can think of. The same goes for showing the message "an email has been send to xzy@abc.com". Now you have the email associated with the account and had the server send an email. Imagine doing that 1,000,000 times.

  • I was thinking about sites where your is your email so there's no information disclosure risk. But that's correct, if users are not emails then that's a real risk you could mitigate by saying instead "an email has been sent to your registered address"
    – Vinko Vrsalovic
    Aug 20 '15 at 9:24
  • Similarly this can be used to discover if an email address has been registered with a site; but this can be gotten around by changing the message to something like "If the email address is registered with us, a reset password link has been sent". Aug 20 '15 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.