Linked Questions

0 votes
1 answer
1k views

Is secure tokens send by email secure? [duplicate]

I'm struggling with the reset password function of a web app, the way i'm inclined to do it is by sending a token based url to the email of the user and than the user can access and reset its password,...
danillosl's user avatar
  • 103
2 votes
2 answers
495 views

Randomness of hash token in password reset link [duplicate]

I want to know what are the points to be kept in mind while creating a hash token for my password reset links. In particular, how to make it un-predictable for an attacker?
Rakesh Singh 's user avatar
0 votes
0 answers
347 views

What is the most secure way to recover password online? [duplicate]

Possible Duplicate: Can anyone provide references for implementing web application self password reset mechanisms properly? I have website which sends generated password to any person who request ...
Andrew Smith's user avatar
25 votes
8 answers
20k views

Are password reset links that don't expire a security risk?

I am currently working on a password reset flow. We have decided to go with a password reset link being emailed to the user's registered email and allowing them to follow that and input a new ...
Austin DeVinney's user avatar
38 votes
3 answers
19k views

How long should a random nonce be?

NIST provides good guidelines on the length of keys and hashes for various algorithms. But I don't see anything specifically on the length of a random or pseudo-random nonce (number used once). If ...
nealmcb's user avatar
  • 20.8k
19 votes
4 answers
10k views

How to implement non-password authentication in a web site

In an answer to this question about pw reset, D.W. says: Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
JDelage's user avatar
  • 293
27 votes
2 answers
9k views

Guidance for implementors of HTTPS-only sites (Server side)

The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...
makerofthings7's user avatar
4 votes
4 answers
2k views

Isn't microtime() or mt_rand() sufficient for password reset?

In Can anyone provide references for implementing web application self password reset mechanisms properly? it is mentioned to use strong cryptographic randomness to generate the reset token that is ...
user avatar
11 votes
2 answers
603 views

What problems does this "recover account" procedure have?

On a website I run I have implemented this procedure for account recovery (forgotten password procedure). I would like to know whether there are any issues with it that I have not spotted, that make ...
Hammerite's user avatar
  • 213
4 votes
1 answer
3k views

Why do some large companies still store passwords in plain text/decrypt-able format? [closed]

In the last couple of weeks I've come across two fairly large companies who seem to not have stringent password security: Tesco - they store passwords in an "encrypted" format, yet they can decrypt ...
Thomas Clayson's user avatar
4 votes
3 answers
413 views

Is emailing a password recovery code as bad as emailing a password in plain text? [duplicate]

I am creating a mobile app where my password recovery feature involves sending a password recovery code (randomly generated string) to the user's email address. They get the code, then enters it ...
Theman's user avatar
  • 149
2 votes
1 answer
2k views

Implementing password-reset in a web application by authtoken over email

I think I have a basic understanding of security concerns, but I feel like if I don't know everything, I'm going to implement lousy solutions. Below is my current strategy; Have I overlooked obvious ...
Alex's user avatar
  • 130