5

Imagine the following scenario:

  • I go to login to MyApp.com, but realized that I forgot my password.
  • I request a new password sent to my email.
  • The email arrives with a link to change the password (but no password is sent).
  • Clicking on the link takes me to a change password screen, but it also logs me in to the account, giving me full access to all the account info. In fact, I don't even need to change the password at all at that point.

Does the above scenario represent a security risk in anyway? If so, how? And what is the way it should be handled instead?

Improve this question

1 Answer 1

Reset to default
2

Well, part of the procedure could be considered to be unsafe: when a user has access to your email account AND knows what websites you might have registered accounts at (like FaceBook, Twitter, Google and the lot). That is probably the most simple and most obvious security issue that might arise here.

We could also take a look at the questions "can the email be intercepted in any way" and "is that recovery-link using a strong, random key or could someone guess it"... but I guess that's overkill. For the regular scenario of password recovery you described, I would say that the only real "security problem" is the one I described above: someone has access to your email and knows what sites to check out and recover your passwords.

As for the damage that might be caused... that depends on what websites the "intruder" is able to recover passwords for. You'll probably won't mind losing your Twitter account in a worst case scenario, but this shows why online-banking accounts do not offer that kind of "password recovery" in the first place. There "could" be a chance someone's watching over your shoulder.

Wrapping it up by giving you a solid hint to work with: if your MyApp.com is something that could financially ruin people when put in the wrong hands, don't use this kind of password recovery... but if you're creating the next Facebook or Twitter, you're good to go with such a recovery procedure.

Hope that helps. ;)

Improve this answer
8
  • I disagree with the last statement. Allowing access to the account as described above, without requiring the password change, leaves the user vulnerable to never having any indication that their account has been hijacked if all the intruder wants to do is view their private data. This should not be permitted in any environment where the user has an (implied or expressed) expectation of privacy for their data. At the very least, e-mail password recovery should force a change before permitting further account access.
    – Iszi
    Commented Dec 20, 2011 at 17:36
  • @Iszi : "At the very least, e-mail password recovery should force a change before permitting further account access. " will not stop those with email access. Besides, being asked to enter a new password or having full access immediately is actually the same kind of security problem. Once you're in, nothing will stop you. The reason is simple: IT'S THE EMAIL ACCOUNT ACCESS THAT'S THE WEAKEST POINT HERE. Break that, and it doesn't matter how MyApp.com protects "password recovery". In fact, you don't disagree, but simply forgot that -to receive the password link- you already have email access.
    – user6373
    Commented Dec 20, 2011 at 18:38
  • I'm not saying forcing a password change makes the account more difficult to hack, but it does enhance visibility of the violation. That's a rather simple and significant mitigation when you compare it to giving an attacker access to your account while leaving you utterly unaware that anything is out of the ordinary.
    – Iszi
    Commented Dec 20, 2011 at 20:58
  • 2
    I'm not talking about logging of any sort - though this should be happening as well. The visibility brought by forcing a password change will be by the end-user wondering why his (presumably) known-good password isn't working anymore. The question asked "Does the above scenario represent a security risk in anyway?". Setting the access violation itself aside, as you have in the last paragraph of your answer, the response is still "yes". Lack of visibility to an access violation is in itself a security risk.
    – Iszi
    Commented Dec 21, 2011 at 1:27
  • 3
    I think we can all safely agree that the original posted model is broken. @Iszi suggested a simple fix which offers some post-attack mitigation value: force the password to be changed rather than allow the user to ignore it. Then any attacker is forced to intercept the change request email, follow the link, change the password, and delete the email to cover their tracks. The important side-effect is that the legitimate user will suspect something has happened the next time they try to log in since their password will no longer work.
    – logicalscope
    Commented Dec 21, 2011 at 6:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .