Skip to main content

Questions tagged [password-reset]

How to let users reset their passwords in a safe manner.

Filter by
Sorted by
Tagged with
4 votes
1 answer
125 views

Is there a problem allowing two accounts to have the same recovery email?

It is a security problem to allow that two different user accounts have the same email address? If the answer is “no problem”, when the user goes to “forgot username” service, should I send an email ...
Pilar's user avatar
  • 41
2 votes
0 answers
592 views

Repeated passwordless login links from linkedin

In the past few weeks I've seen periodic attempts of someone logging in to my linkedin accounts. They appear to use some sort of one time login link feature that linkedin has, which allows ...
Ccm's user avatar
  • 143
1 vote
2 answers
364 views

Is it bad practice to prompt users to reset password when there is no evidence of a breach?

I have received many security emails from LinkedIn over the past few weeks. An example is shown below (redaction mine) I do not live in the USA and I did not try to access LinkedIn at the times these ...
Josh's user avatar
  • 111
3 votes
1 answer
395 views

Should newly password links reset old ones? if so, why?

I have noticed on most websites that all previous password reset links are automatically expired when a new one is requested. Why is this so common and what are some possible consequences if this isn'...
user17886134's user avatar
8 votes
3 answers
6k views

Pros & cons of including requesting IP address in password reset emails?

It has crossed my mind to include the requesting IP address in password reset emails. The intention being that if someone is receiving unexpected reset emails, this allows them to do a basic level of ...
paj28's user avatar
  • 33.8k
0 votes
0 answers
107 views

How could one use multi-factor authentication to derive a static secret key?

Scenario: The setup is that each user has a randomly generated key A used for encrypting data stored on the server and a password-derived key B used to store A on the server without the server getting ...
n-l-i's user avatar
  • 421
3 votes
4 answers
396 views

When resetting password after forgetting it, why is there a need to notify "Password cannot be your previous password"?

This is from the perspective of someone who had supposedly forgotten their password. We're doing this project wherein we "secure" an application that was given to us. We added this "...
Marasmius's user avatar
0 votes
1 answer
632 views

How to generate actually valid NTLM hash for chntpw (for SAM hive file injection)

I am currently working on a solution to at least try to implement a working/modern "change password" option to chntpw. First of all: Windows uses this format in its hive file: root@rescue /...
HeartOfGermany's user avatar
1 vote
2 answers
138 views

exploiting the scenario and how to generate a secure reset password token

I am using the following line of code to create a reset password code sent to the user in her/his email. when scanned with brakeman to my ruby code, this line of code is catched and describes it as it ...
hanan's user avatar
  • 131
1 vote
0 answers
77 views

Pre-Hijacking Mitigation

I want to create a website with password login and social login (e.g. Google only.) For password login, first I will send a verification email. I want to prevent pre-hijacking. For those who do not ...
ihsan çiftci's user avatar
0 votes
1 answer
129 views

Password reset encryption mechanism based on username [duplicate]

Short I known 0x02135 gets encrypted to -> NzY4MzY5 0x02136 gets encrypted to -> NzcxMzc0 ...etc I want to know 0x02137 will get encrypted to -> ??? (in ...
Dang Max's user avatar
0 votes
1 answer
174 views

Password Recovery email - secure enough?

I am currently implementing new auth schemes for a site, and decided to implement an "I forgot my password" email looking at this guide for inspiration. My Flow The flow I have designed is ...
JoSSte's user avatar
  • 151
0 votes
0 answers
3k views

Windows hello pin removal/crack

Is there a workaround to the Windows 10 Hello PIN security login policy? The PIN is the only credential needed to log in, no password is set, checked with samdump2. I inherited this computer from a ...
Polina's user avatar
  • 1
10 votes
3 answers
5k views

Isn't "BIOS reset password" a security flaw?

According to this article Dell Support can help a user to gain access to data after forgetting the HDD password: Once Dell Support has provided the reset password, you enter this when prompted and ...
haba713's user avatar
  • 215
1 vote
0 answers
142 views

Web password reset steps

I'm trying to implement authentication for users on a web page using JWT tokens and, so far, I can create users and authorize them. I'm now trying to write the password reset functionality and I think ...
mirkaim's user avatar
  • 21
1 vote
1 answer
223 views

Reset password parameters to send

I'm building a web app in Node.js, Express, and Mongoose. I'm worried about security and optimization issues on what to send in the email link. I see many of them sending: /:userId/:token, but if I ...
anto12345's user avatar
0 votes
3 answers
287 views

Send password reset email after too many failed logins versus X minutes of lock out

Some sites lock me out for a while after too many failed attempts. For our own site, we want to force a password reset email after X amount of failed attempts. After all, if your email is compromised, ...
Dirk Boer's user avatar
  • 539
0 votes
0 answers
482 views

EFS-encrypted files not lost when domain admin resets password

There are many articles out there stating that a user's encrypted files are lost after an administrator resets the password of that user. I tried: Logged on as user (Domain User) with password 54321 ...
TomS's user avatar
  • 101
0 votes
4 answers
353 views

Forget Me Not? Abandoning the Forgot Password Functionality

They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it ...
Bradford Griggs's user avatar
0 votes
1 answer
203 views

If my home router password was reset, is that a sign of a security breach?

Recently I started having issues with my home Wi-fi connection. My devices showed as connected to the router, but no Internet was coming through. While trying to log into the router through my browser ...
Village's user avatar
  • 863
0 votes
1 answer
167 views

How to force web sites and services to stop resetting passwords of accounts without user's permission and prompt? [closed]

A new trend in account security is spreading: web services like LinkedIn reset passwords automatically when detect attempts of getting access with wrong password or from new locations. Thus, a user ...
Aleksey F.'s user avatar
-1 votes
1 answer
172 views

How to guess 8 character long reset token [closed]

Reset token contains lower case a-z, 0-9 number, there will be at maximum 5 number, at minimum there will be 0 number. It is randomly generated. How many possiblities do we have? How much time does ...
unurucle's user avatar
3 votes
2 answers
869 views

Best practice to change password while user is already logged in

What is the best practice for changing passwords while the user is already logged in? In my application to change the password, the user who is already logged in has to pass the current password and a ...
user187205's user avatar
  • 1,343
1 vote
3 answers
593 views

Is it safe to send an encrypted blob as a URL parameter?

The context is a password reset functionality. The user has requested a password reset, either via the web, or via a call to the help desk. The proposed solution is, behind the scenes: If Self-...
John Arrowwood's user avatar
0 votes
3 answers
718 views

How many bytes for password reset token? Should one take steps to hash or conceal raw CSPRNG bytes?

I'm trying to follow the OWASP 'Forgot Password Cheat Sheet' recommendations for password reset functionality via email. This requires my server to generate a token. OWASP says that PHP's random_bytes(...
S. Imp's user avatar
  • 226
1 vote
1 answer
822 views

Benefits of only allowing one password reset per day? [duplicate]

I recently had to reset my password for a popular instant messaging service. Unfortunately, I failed to write down the new password I picked. So I had to reset the password again. That is when I got ...
Anders's user avatar
  • 65.7k
2 votes
2 answers
1k views

Why should password reset link be single use?

Reading from here: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html It mentioned that password reset link should be single use and expire after appropriate period. I don'...
Farid's user avatar
  • 121
1 vote
2 answers
1k views

Hashing bcrypt password hash for use as a password reset token

There is an existing user database that has the following columns: userId (v4 uuid) created timestamp bcrypt password hash email I must add a password reset functionality and I cannot add any new ...
Andriy Kharchuk's user avatar
2 votes
1 answer
1k views

Allowing a password reset if an account is locked

Similar to another question about keeping an account locked, is it preferable to allow a user to reset their password while the account is locked out due to the wrong password being used too many ...
8BitCoder's user avatar
  • 123
1 vote
1 answer
202 views

How do sites detect credential sniffing, and what is the purpose of this attack?

I just got an email from the Unsplash service telling me that someone had logged into my account via credential sniffing: Five minutes later I get three more emails, each one notifying that a (...
Hashim Aziz's user avatar
2 votes
0 answers
512 views

In forgotten password is asking user their TOTP among other details secure?

I have started to work on the Forgotten password feature on my website. Based on OWASP Forgot Password cheatsheet, the user should provide enough information to confirm that it is really them. The ...
vakus's user avatar
  • 3,843
3 votes
2 answers
877 views

What's the security risk in password recovery attempts

I'm the administrator of a Wordpress site, with just two users: me and one other user. Last days I've received multiple password recovery attempts for that other user (as an administrator I get a mail ...
Coder14's user avatar
  • 133
18 votes
1 answer
5k views

Why does Windows not always force me to confirm my password when changing it?

If I can change my password with cmd net user example * without needing to confirm my old password, why, when I change my password in the usual way (via settings or control panel), do I need to ...
Stalemate's user avatar
  • 183
2 votes
3 answers
944 views

Best practice for authenticating resend email requests

I have a Node.js/Express 4/JWT user authentication service using Passport.js, with Sequelize and MySQL for database. In my service, upon signing up/resetting a password, the user will be redirected to ...
SKNB's user avatar
  • 121
0 votes
1 answer
254 views

Password-reset mechanism based on Sessions

I was wondering if the following password-reset mechanism is safe: The user clicks on 'I forgot my password' and enters his mail. After he has submitted, a security_token gets generated. This token ...
O'Niel's user avatar
  • 2,916
27 votes
7 answers
7k views

Where should I store a username during a password reset?

I am new to web development and am trying to implement a password reset feature according to the OWASP cheat sheets: Forgot Password Cheat Sheet The cheat sheet advises not to send the username as a ...
Sam's user avatar
  • 388
2 votes
2 answers
226 views

Website attack: What is the attacker's goal?

A bot network(?) has been after my website for quite a while now. Here is a breakdown of what they do: They register several accounts using random characters for building a first and last name which ...
Armin Hierstetter's user avatar
0 votes
1 answer
4k views

Reflected XSS in form action - understanding

I am trying to learn basics of web security vulnerabilities. I have found a website, where on reset password, you get a link in the email with a token, and when you click this link, the webpage opens ...
gaurav5430's user avatar
1 vote
3 answers
3k views

What is the best practice for resetting multi-factor when a user requests to recover their password?

I am in the process of developing a web-application which requires MFA on every login. (On the first login, before you can do anything, you are forced to setup MFA. Due to monetary restrictions and ...
JakGuru's user avatar
3 votes
0 answers
462 views

Repeated Microsoft password reset requests - Should I be concerned?

Background Since the middle of last month, I have started receiving multiple Microsoft password reset e-mails a day, sent to my secondary e-mail address, regarding my primary e-mail address. These e-...
Scott Dennison's user avatar
0 votes
1 answer
101 views

Resetting password upfront, before getting email

I recently reset my password on a site that had me enter the new password I wanted to use upfront at the same time I said what email I wanted to reset it for. Then all I had to do was click the link ...
BVernon's user avatar
  • 181
0 votes
2 answers
1k views

Should password reset disable biometric sign in until the user signs in with username and password again?

Background: My team's mobile apps have biometric sign in (Touch ID, Face ID, fingerprint). You can enable and disable biometric sign in when you are signed in. You always have the option to sign in ...
Aaron B's user avatar
  • 103
14 votes
2 answers
12k views

How does password reset work if 2FA is enabled?

(There is a highly related question, however I believe mine is not a duplicate, since it deals with resetting a password without access to the account, not changing it while being logged in.) Say ...
dzejkob's user avatar
  • 333
2 votes
2 answers
2k views

Where should 'reset password' functionality be?

We've recently overhauled the backend to our mobile app from having a very basic authentication mechanism that went through the API to having both an authentication server and an API server, with the ...
Jez's user avatar
  • 314
3 votes
1 answer
2k views

Implications of a 6 digit password reset token

I'm designing a password reset system for my website/app right now and I'm not sure if the solution that I've reached could be considered suitably secure. The steps for resetting a password are as ...
Luke Carr's user avatar
33 votes
6 answers
11k views

Password reset giving clues of possible valid email addresses

We have a system where if you forgot your password and want to reset it, to go to the forgot password page and enter your email address. A temporary link will be sent to your email to reset your ...
davshowhan449's user avatar
3 votes
3 answers
1k views

Password reset link vs Temporary password

Which is harder to exploit: Password reset link with tokens/timestamps/code/ticket etc Or, temporary password sent on user mail using which login can be done and password can be changed. Any ...
user228198's user avatar
2 votes
0 answers
202 views

Admin able to set new plaintext user password - security problem?

I am working on this application that can be deployed and run by anyone on their server. Most often, it is run as a web service. In our new version, we removed the possibility for admins to set and ...
Chimarr's user avatar
  • 63
0 votes
0 answers
28 views

How to approach a site that doesn't manage passwords correctly? [duplicate]

I am registered to a site which doesn't manage password correctly. It is a user area for a company that provides services of some sort and which uses the area to show details of the contracts and for ...
bracco23's user avatar
  • 123
1 vote
0 answers
221 views

How to implement a "Forgot password?" functionality using php-encryption's KeyProtectedByPassword and 2FA?

I'm currently migrating the encryption functionality used in a PHP project from mcrypt (which was deprecated in PHP 7.1.x and no longer works from PHP 7.2 onward) to openssl, using the defuse/php-...
Sarah C. Groß's user avatar