Questions tagged [password-reset]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
113 views

In forgotten password is asking user their TOTP among other details secure?

I have started to work on the Forgotten password feature on my website. Based on OWASP Forgot Password cheatsheet, the user should provide enough information to confirm that it is really them. The ...
3
votes
2answers
174 views

What's the security risk in password recovery attempts

I'm the administrator of a Wordpress site, with just two users: me and one other user. Last days I've received multiple password recovery attempts for that other user (as an administrator I get a mail ...
18
votes
2answers
5k views

Why does Windows not always force me to confirm my password when changing it?

If I can change my password with cmd net user example * without needing to confirm my old password, why, when I change my password in the usual way (via settings or control panel), do I need to ...
0
votes
2answers
99 views

Best practice for authenticating resend email requests

I have a Node.js/Express 4/JWT user authentication service using Passport.js, with Sequelize and MySQL for database. In my service, upon signing up/resetting a password, the user will be redirected to ...
0
votes
1answer
28 views

Password-reset mechanism based on Sessions

I was wondering if the following password-reset mechanism is safe: The user clicks on 'I forgot my password' and enters his mail. After he has submitted, a security_token gets generated. This token ...
27
votes
7answers
6k views

Where should I store a username during a password reset?

I am new to web development and am trying to implement a password reset feature according to the OWASP cheat sheets: Forgot Password Cheat Sheet The cheat sheet advises not to send the username as a ...
2
votes
2answers
130 views

Website attack: What is the attacker's goal?

A bot network(?) has been after my website for quite a while now. Here is a breakdown of what they do: They register several accounts using random characters for building a first and last name which ...
0
votes
1answer
103 views

Reflected XSS in form action - understanding

I am trying to learn basics of web security vulnerabilities. I have found a website, where on reset password, you get a link in the email with a token, and when you click this link, the webpage opens ...
0
votes
3answers
107 views

What is the best practice for resetting multi-factor when a user requests to recover their password?

I am in the process of developing a web-application which requires MFA on every login. (On the first login, before you can do anything, you are forced to setup MFA. Due to monetary restrictions and ...
2
votes
0answers
141 views

Repeated microsoft password reset requests - Should I be concerned?

Background Since the middle of last month, I have started recieving multiple microsoft password reset e-mails a day, sent to my secondary e-mail address, regarding my primary e-mail address. These e-...
0
votes
1answer
31 views

Resetting password upfront, before getting email

I recently reset my password on a site that had me enter the new password I wanted to use upfront at the same time I said what email I wanted to reset it for. Then all I had to do was click the link ...
0
votes
2answers
68 views

Should password reset disable biometric sign in until the user signs in with username and password again?

Background: My team's mobile apps have biometric sign in (Touch ID, Face ID, fingerprint). You can enable and disable biometric sign in when you are signed in. You always have the option to sign in ...
8
votes
2answers
3k views

How does password reset work if 2FA is enabled?

(There is a highly related question, however I believe mine is not a duplicate, since it deals with resetting a password without access to the account, not changing it while being logged in.) Say ...
1
vote
2answers
88 views

Where should 'reset password' functionality be?

We've recently overhauled the backend to our mobile app from having a very basic authentication mechanism that went through the API to having both an authentication server and an API server, with the ...
1
vote
1answer
141 views

Implications of a 6 digit password reset token

I'm designing a password reset system for my website/app right now and I'm not sure if the solution that I've reached could be considered suitably secure. The steps for resetting a password are as ...
31
votes
6answers
7k views

Password reset giving clues of possible valid email addresses

We have a system where if you forgot your password and want to reset it, to go to the forgot password page and enter your email address. A temporary link will be sent to your email to reset your ...
1
vote
2answers
171 views

Password reset link vs Temporary password

Which is harder to exploit: Password reset link with tokens/timestamps/code/ticket etc Or, temporary password sent on user mail using which login can be done and password can be changed. Any ...
3
votes
2answers
284 views

Creating a Password Policy for a Bank Corporation, what must one take into consideration?

When creating a Security Policy such as Password Policy, what are some of the typical assets that need to be protected? And how does this affect, employees, contractors, vendors, suppliers, and ...
2
votes
0answers
110 views

Admin able to set new plaintext user password - security problem?

I am working on this application that can be deployed and run by anyone on their server. Most often, it is run as a web service. In our new version, we removed the possibility for admins to set and ...
0
votes
0answers
27 views

How to approach a site that doesn't manage passwords correctly? [duplicate]

I am registered to a site which doesn't manage password correctly. It is a user area for a company that provides services of some sort and which uses the area to show details of the contracts and for ...
1
vote
0answers
83 views

How to implement a “Forgot password?” functionality using php-encryption's KeyProtectedByPassword and 2FA?

I'm currently migrating the encryption functionality used in a PHP project from mcrypt (which was deprecated in PHP 7.1.x and no longer works from PHP 7.2 onward) to openssl, using the defuse/php-...
2
votes
3answers
88 views

Benefits of signing a random number?

Is there any benefit to signing a random number? E.g. a link for password reset, sent to email, often includes a base64 encoded random number to prevent someone guessing what the password reset link ...
1
vote
3answers
281 views

Is an 8 characters long password reset token strong enough?

I am testing a website with a password reset functionality that provides a link with a token like most websites. I asked for multiple password reset links to see any pattern in the tokens. All the ...
1
vote
2answers
349 views

When resetting a password using OTPs, how can I prevent users from bypassing the OTP input page?

I am implementing the password reset functionality using OTPs (one-time passwords). When the user clicks on the 'forgot password' link, he / she is sent an OTP and is redirected to the OTP input page. ...
2
votes
3answers
374 views

Password reset vs change

My webapp has "password reset" and "password change" functionality. Password "reset" is typical: user clicks "I forgot my password", enters his email, one-time link emailed there, he visits a form to ...
0
votes
2answers
13k views

Possible attack via Netflix; what action should I take, if any?

Late last night I received a "password reset" email from info@mailer.netflix.com. It looked legit, but I had not requested a password reset. I checked my account's "recent account access" but saw ...
6
votes
2answers
4k views

How to properly create a password reset token?

I searched for a long time, and never really find any articles or posts that fully explain how a password reset token should be created. What I know so far: It should be random. Its hash should be ...
32
votes
2answers
5k views

Ability To Change Root User Password (Vulnerability?)

I am studying for my RHCSA exam, and one of the topics is the ability to "change a forgotten root user password." This is an official exam objective and even has official Redhat documentation. How ...
0
votes
1answer
250 views

Is detecting if an email has an account considered a vulnerability with AWS cognito?

Am doing a pen test on a client system using AWS Cognito and userpools for authentication using the client side SDK provided by AWS. during the forget password flow, I noticed that Cognito request ...
0
votes
1answer
96 views

Is there a way to post directly to the server without going client side?

I was pentesting a web app and while doing a password change, the client checks for the old password but not the server. Also they've a CSRF vulnerability. So would it be possible to post directly to ...
0
votes
1answer
43 views

Safe to consider webapp user's email as implicitly confirmed after a password reset?

In my system, a new user must confirm his email. But there is an edge case: he registers does not confirm forgets password, performs password reset (which involves a mail loop) At that point I know ...
2
votes
1answer
407 views

Anti-CSRF mechanism in a form changing password with an old password input is it required?

What is the risk for a form changing password with an old password input that doesn't have CSRF protection? A form without an old password input, I understand the risk but if the old password input ...
34
votes
6answers
8k views

How do I reset passwords on multiple websites easily?

One of my old email addresses was involved in the recent Whitepages breach disclosure (source: Have I Been Pwned). I don't remember on which websites I used that email address for registration, but I ...
0
votes
2answers
467 views

Account Recovery: Displaying username without verification

I'm not a security guy, so bear with me. As discussed in other topics, usernames in and of themselves are valid forms of verification, and there's nothing particularly sensitive or secure about ...
2
votes
1answer
120 views

Secure password reset before authentication?

I have recently been considering the password reset flow for a site I'm working on. A request came up that before authentication, a user should have an option to change their password by providing: ...
4
votes
3answers
188 views

How to reset passwords without emailed reset link?

In an offline system what is the preferred method of resetting a user's password? Usually this would be handled with an emailed password reset link. However this system is offline, there is no access ...
1
vote
3answers
692 views

When you enable 2FA, why is your second factor required to reset password?

In a conversation with a coworker the other day, I had trouble successfully defending why, when you enable 2FA on a service, you're required to enter a second factor before changing your password (in, ...
3
votes
3answers
304 views

When websites use SMS as part of a password reset scheme, why do they ask for the user's phone number?

I've noticed if you do a password reset on iCloud, for example, it prompts you for your phone number before sending the SMS. Since many people already know your phone number, or it may be listed ...
2
votes
1answer
456 views

Storing password reset token in DB - what are the implications?

In multiple systems I've built/supported I've seen user management do the following for password reset: generated a password reset token via some hashing method and email the link with token to user. ...
1
vote
2answers
355 views

Is it good to auto log out users after when they change password?

Is it a good practice to implement automatic log-out in an android App after changing the password through the app?
6
votes
2answers
2k views

How long should a password reset token remain valid?

What is the recommended lifetime of a password reset token? Too short will degrade user experience and too long would compromise security. Microsoft identity default to one day but this very long.
3
votes
2answers
163 views

Android Security - Giving Google Your Phone Number

While setting up my Android account on my phone, I am asked If you like, you can add this phone's number to your account .... ..for example you number will be used to: Reset your password if you ...
2
votes
1answer
879 views

Password Reset URL strategy

Designing a new flow for a "forgot your password" feature we are developing, i came across a challenging question regarding the URL and the commitment that has to be made between frontend and backend ...
0
votes
2answers
311 views

Reseting passwords using IP address

I sent a password reset request, to reset an account of mines and after having some talk with a rep I told him I forgot the email to the account which he told me to just provide the IP address that I ...
8
votes
1answer
375 views

What is a “Cookie Swap” password reset attack?

Am looking over Blackhat appsec trainings and googling. They mention a type of attack for "Password Reset Attacks" known as "Cookie Swap"; see here. While I do not like to make these type of posts I ...
3
votes
1answer
247 views

Is this “forgotten-password” procedure safe/legal?

Recently, I had lost my password on a web app that is supposed to be really secure (think bank or government type web app). This web app contains a lot of personnal critical infos (like SSN and salary,...
2
votes
5answers
181 views

Is it helpful to slow down the password reset function?

I've implemented a password reset function for a website I'm working on. By default, the function is very fast, and I'm wondering if it would be helpful, from a security standpoint, to intentionally ...
0
votes
1answer
204 views

Why would a password reset method be like this? Is it especially safe?

The library of the Technical University in my city (Europe) has a password reset system which I did not encounter anywhere else. Students have to go to some office inside the university to get a new ...
27
votes
10answers
5k views

How to strike a balance between security policies and practical implementation challenges? [duplicate]

At our organization, we came across some frequent incidents such as: Reported successful password guessing attacks Frequent password reset complaints We started an investigation to identify the ...
7
votes
2answers
448 views

Is there value in changing your password after failed (malicious) login attempts?

I just received an email from Citi saying "We've locked your access for 24 hours due to multiple failed login attempts." and "If you didn’t attempt these logins, we recommend that you reset your ...