Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

The tag has no usage guidance.

3
votes
1answer
144 views

Is this “forgotten-password” procedure safe/legal?

Recently, I had lost my password on a web app that is supposed to be really secure (think bank or government type web app). This web app contains a lot of personnal critical infos (like SSN and salary,...
0
votes
0answers
42 views

Is it helpful to slow down password reset function

I've implemented a password reset function for a website I'm working on. By default, the function is very fast, and I'm wondering if it would be helpful, from a security standpoint, to intentionally ...
0
votes
0answers
16 views

Was RocketMail part of Yahoo's data breach?

Since Yahoo's massive 2013 data breach we have refused to accept Yahoo/Ymail email addresses as personal recovery accounts for GSuite. I'd like to know if: RocketMail accounts were included in that ...
0
votes
1answer
190 views

Why would a password reset method be like this? Is it especially safe?

The library of the Technical University in my city (Europe) has a password reset system which I did not encounter anywhere else. Students have to go to some office inside the university to get a new ...
27
votes
10answers
5k views

How to strike a balance between security policies and practical implementation challenges? [duplicate]

At our organization, we came across some frequent incidents such as: Reported successful password guessing attacks Frequent password reset complaints We started an investigation to identify the ...
6
votes
2answers
294 views

Is there value in changing your password after failed (malicious) login attempts?

I just received an email from Citi saying "We've locked your access for 24 hours due to multiple failed login attempts." and "If you didn’t attempt these logins, we recommend that you reset your ...
3
votes
1answer
71 views

Duo Security forgot password workflow

I'm updating my company's forgot password workflow. Currently we use Duo Security as our second factor on login (but for the purposes of my question this can be any such service). I've been walking ...
0
votes
0answers
43 views

Policy for regaining access to a colleague's account

I run a SaaS used by teams to collect company-related information (think something like Crashlytics). Even if the tool lets users invite their colleagues, we often find cases of individuals who ...
50
votes
5answers
10k views

Should I log that a user changed their password?

Are there any security concerns with logging that a user changed their password? I'm already logging whenever an admin changes a users password for audit purposes, but is there a reason to not have a ...
4
votes
2answers
211 views

Should a “password reset” link be valid after changing email?

Here's the scenario: Your account has multiple active “password reset” links out in the world. They expire after 24 hours, and after you change your password. Instead of changing your password, you ...
3
votes
3answers
175 views

Password manager and account recovery

I'd like to start using a password manager, but I'm not sure how to handle account recovery. I'm not a criminal or a secret agent, so if I lose my master password (or my second authentication factor, ...
1
vote
1answer
44 views

self reset password with MFA

I need to implement a reset password feature with Multifactor authorization. The plan is to use these 2 factors: ask a security qs and email/sms a code to the user. I think the order of these should ...
3
votes
1answer
41 views

Providing a SMS recovery feature without compromising the security of an account

I'm designing a system so that it encrypts a user's profiles. The only way of accessing the information stored in it is by either: Providing the password for the account Resetting the password using ...
4
votes
1answer
97 views

If a user changes password should it make all API keys invalid?

When a user changes their password this will force all users who is logged in on the website via cookies to be forced to login again. However, there is a mobile application that logs in the user via ...
2
votes
2answers
94 views

When and why to send an email notification of password reset

The Devise documentation states that "For security purposes, sometimes you need to notify users when their passwords change." In general, when would you need to provide such notification, and why?
2
votes
2answers
176 views

Is it bad to let admins change a users e-mail when resetting passwords?

I'm confused about how to implement password reset functionality. I'm testing a Web application with two roles - administrator and normal user. Only administrators can use the password reset ...
1
vote
0answers
30 views

Asus tablet/laptop [closed]

I need to crack my Asus. My roommate put a password on it and I can't figure it out. The password hint on the login page says crazed. If anybody knows how to get in this M.F. P.O.S. It would be ...
3
votes
1answer
181 views

Convince colleagues that resetting passwords on behalf of users is dangerous

We have a web application which requires users to log in with username and password. We have a password reset feature for users which more or less successfully follows the guidelines outlined by Troy ...
0
votes
1answer
76 views

How do authentication system know if I am reusing a password? How is this secure?

My question is how is it possible to know if I am reusing a password? Are they storing my old password as well [in plaintext]? If an admin had access to the backend, wouldn't they have access to all ...
4
votes
2answers
419 views

Wordpress hacker generating password reset request for admin user

I have received a few password reset emails for the "admin" user (ie login name admin) in an old (but patched up-to-date) Wordpress install. The owner of the site did not request these password ...
3
votes
2answers
158 views

Should users be allowed to reset their password to the current one?

I've been trying to answer the following question but can't seem to find a clear answer... When a user resets their password after forgetting it, should they be allowed to change it to the password ...
-4
votes
5answers
368 views

is my scheme is less secure than the 99% of websites exposed to theses attacks? [closed]

I develop a sort of social network for mobile and desktop browser with a REST API. I can't ask to users to buy a U2F key or any hardware (but I could propose to support it if they have, since Chrome/...
6
votes
1answer
143 views

Alternatives to SMS as a out-of-band channel

I am looking at password reset functionality for a project I am working on. Looking at OWASP guidelines, it suggests using SMS as an out-of-band channel for this. ( https://www.owasp.org/index.php/...
3
votes
1answer
697 views

Best practices for generating and using random timed OTP

Suppose I want to implement an OTP system that generates 6 to 10 digit numbers. (assume its used for reset password, or send money) The OTPs have an expiry time, so they keep getting removed from the ...
1
vote
2answers
53 views

Show if e-mail exists or not [duplicate]

Any security issues showing if a certain e-mail address was found in a database or not when a enduser requests a password-reset on a certain homepage or should the homepage just return some kind of ...
1
vote
5answers
721 views

Using the password hash as a reset token

I had this idea, that instead of generating a password reset token and emailing it to the user, I simply email the user's hashed password to them. Then upon reset, the user would submit the old hashed ...
0
votes
1answer
39 views

Reset Password Link input parameters - where do place?

Which is more recommended? The user security questions are asked before the forgot password reset link is send to email? or Security questions are asked in the page that shows up right after the ...
3
votes
1answer
351 views

How disable “last password you remember” of Google, after knowing that someone has my password?

I have received this email from Google: Someone just used your password to try to sign in to your Google Account xxxxxx@gmail.com. Details: Sunday, July 9, 2017 11:27 AM (France Time) *****...
3
votes
3answers
138 views

How to reset account passwords after falling victim to password reuse?

I recently had one of my accounts compromised after falling victim to an online phishing scam. To make matters worse, while I've used unique passwords for any account created in the past few years, my ...
5
votes
1answer
445 views

If my phone for two factor authentication is stolen, can the attacker access my account via an email password reset?

Suppose I setup an online account with 2FA on my phone, and an attacker gains access to my phone. My phone is logged into my email account. The attacker knows my online service's account username or ...
1
vote
1answer
80 views

Benefits of Facebooks new “Trusted Friends” feature

Today on my Facebook I saw a new (to me at least) feature to access your account if you lose access somehow. The process is simple. You add 3 to 5 friends as trusted friends. Then if you lose access ...
0
votes
1answer
69 views

Is it secure for a user to manually reset his password on every login when OTP isn't forced?

Is it secure for a user to manually reset his password every login (via email or 2 factor authentication) to a random token via email or 2 factor authentication, when OTP isn't forced ? I mean an ...
0
votes
3answers
475 views

My router got hacked, do I need to reset all 9 devices in my house?

My router got hacked. And people suggest that the best way is to factory reset the router, then reset all the devices using the network. I'm getting a new router so the reset router part is solved. ...
0
votes
3answers
124 views

Password reset mail - reset password again [duplicate]

Let's assume this situation: I am a user of an online shop, I forgot my password. So I use the functionality of this online shop to reset my password. The online shop sends me an email with a link I ...
3
votes
1answer
312 views

ASP NET Core Identity password reset form prompts for email address

I notice that the default ASP.NET Core Identity templates ask for email address after the reset email notification link has been followed (i.e. the "choose a new password" form in the ResetPassword....
8
votes
3answers
696 views

Forgot your password: “New password must have a minimum of 4 characters different from the previous password” [duplicate]

This was found on a password reset feature of a government website, where you enter your username, then it takes you to a screen where you can enter a new password enter confirmation of new password ...
3
votes
1answer
55 views

Should we confirm other personal details before security questions during password resets?

I've been tasked to work on a password reset tool for my company website. This tool is for a support person to provide a new reset password over the phone in case the customer does not receive the ...
103
votes
5answers
19k views

How can waiting 24 hours to change the password again be secure?

So I managed to change my password on a service to the "wrong" password, for simplicity let's just say I changed it to an insecure password. Now, I wanted to change it to a more secure password but ...
5
votes
1answer
2k views

one-time JWT token with JWT ID claim

I'm trying to figure out how to issue a one-time use JWT token for password reset feature and still keeping it stateless. Came across Single-Use Tokens w/ JWT which basically suggests to include hash ...
1
vote
2answers
109 views

Password-Changing Password

I want to create a public (password given out to everyone) gmail account that anyone can use (for subscriptions, using useful websites that require your real email but spam you, etc.) and that's the ...
0
votes
2answers
124 views

If Cloudbleed affected a site that uses Facebook login, do I need to reset my Facebook password? [duplicate]

I got an email from at least one site saying they use Cloudflare and due to the recently discovered leak they're recommending I change my password on their site. But I don't have a password on their ...
1
vote
4answers
135 views

Should users be allowed to login with the same password when a password change is requested but not changed?

I have noticed that some sites would not let you login with the old password if a new password is requested, but was not changed. Example: I forgot my password and requested a new one in the email. ...
0
votes
1answer
100 views

Steps to secure an account where an attacker keeps resetting the password [closed]

I have an account on a major company website that has for some reason fallen under attack. Periodically over the course of the day I will get a text message from the company saying your password has ...
1
vote
1answer
127 views

How is Facebook's new delegated recovery more secure than a traditional recovery system

I was reading through the delegated password recovery process introduced by Facebook. I am trying to relate the whole process with traditional password recovery mechanisms (i.e., sending a reset ...
1
vote
2answers
195 views

Is using password_verify($password, “”) to block access to an account secure?

We are migrating an old website, which used pretty old password hashing to the new php password verify function. The old method used an old hash, and we would like to use password_verify instead of ...
1
vote
1answer
130 views

Resetting password everytime you login

It is a good idea in terms of security wise, to reset your password everytime you login and just fill your password with a bunch of random symbols,letters and words that you don't memorise? Since ...
8
votes
3answers
2k views

Why are one time password reset links safer than one time passwords?

Recently I applied for a job at a company creating security-critical solutions for military, aerospace, ... After registering at their webpage, I received an email with my username and a ...
0
votes
1answer
308 views

Forgot Password Vulnerability

I visited my bank's website today with the intention of logging in to do bank stuff. I entered my username and hit enter on accident without entering a password. It took me to a page to select how I ...
2
votes
6answers
177 views

Password reset - Cryptographically signed user ID and timestamp or randomly generated value?

What are the pros and cons of the different ways of handling reset links? I see two ways of handling them: Generate a random string, for example with uuid4. Store it in the database with the user and ...
4
votes
1answer
318 views

Using a gmail oath2 token to access web email

I forgot my password to an old gmail account. I have tried the regular route of going through gmail password recovery: answering questions, it keeps looping back to the questions, so I think I'm ...