The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [password-reset]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
3answers
77 views

Benefits of signing a random number?

Is there any benefit to signing a random number? E.g. a link for password reset, sent to email, often includes a base64 encoded random number to prevent someone guessing what the password reset link ...
0
votes
3answers
160 views

Is an 8 characters long password reset token strong enough?

I am testing a website with a password reset functionality that provides a link with a token like most websites. I asked for multiple password reset links to see any pattern in the tokens. All the ...
1
vote
2answers
108 views

When resetting a password using OTPs, how can I prevent users from bypassing the OTP input page?

I am implementing the password reset functionality using OTPs (one-time passwords). When the user clicks on the 'forgot password' link, he / she is sent an OTP and is redirected to the OTP input page. ...
2
votes
3answers
164 views

Password reset vs change

My webapp has "password reset" and "password change" functionality. Password "reset" is typical: user clicks "I forgot my password", enters his email, one-time link emailed there, he visits a form to ...
0
votes
2answers
609 views

Possible attack via Netflix; what action should I take, if any?

Late last night I received a "password reset" email from info@mailer.netflix.com. It looked legit, but I had not requested a password reset. I checked my account's "recent account access" but saw ...
2
votes
2answers
219 views

How to properly create a password reset token?

I searched for a long time, and never really find any articles or posts that fully explain how a password reset token should be created. What I know so far: It should be random. Its hash should be ...
32
votes
2answers
4k views

Ability To Change Root User Password (Vulnerability?)

I am studying for my RHCSA exam, and one of the topics is the ability to "change a forgotten root user password." This is an official exam objective and even has official Redhat documentation. How ...
0
votes
1answer
120 views

Is detecting if an email has an account considered a vulnerability with AWS cognito?

Am doing a pen test on a client system using AWS Cognito and userpools for authentication using the client side SDK provided by AWS. during the forget password flow, I noticed that Cognito request ...
0
votes
1answer
94 views

Is there a way to post directly to the server without going client side?

I was pentesting a web app and while doing a password change, the client checks for the old password but not the server. Also they've a CSRF vulnerability. So would it be possible to post directly to ...
0
votes
1answer
40 views

Safe to consider webapp user's email as implicitly confirmed after a password reset?

In my system, a new user must confirm his email. But there is an edge case: he registers does not confirm forgets password, performs password reset (which involves a mail loop) At that point I know ...
2
votes
1answer
193 views

Anti-CSRF mechanism in a form changing password with an old password input is it required?

What is the risk for a form changing password with an old password input that doesn't have CSRF protection? A form without an old password input, I understand the risk but if the old password input ...
34
votes
6answers
7k views

How do I reset passwords on multiple websites easily?

One of my old email addresses was involved in the recent Whitepages breach disclosure (source: Have I Been Pwned). I don't remember on which websites I used that email address for registration, but I ...
0
votes
2answers
111 views

Account Recovery: Displaying username without verification

I'm not a security guy, so bear with me. As discussed in other topics, usernames in and of themselves are valid forms of verification, and there's nothing particularly sensitive or secure about ...
2
votes
1answer
105 views

Secure password reset before authentication?

I have recently been considering the password reset flow for a site I'm working on. A request came up that before authentication, a user should have an option to change their password by providing: ...
4
votes
3answers
178 views

How to reset passwords without emailed reset link?

In an offline system what is the preferred method of resetting a user's password? Usually this would be handled with an emailed password reset link. However this system is offline, there is no access ...
1
vote
3answers
173 views

When you enable 2FA, why is your second factor required to reset password?

In a conversation with a coworker the other day, I had trouble successfully defending why, when you enable 2FA on a service, you're required to enter a second factor before changing your password (in, ...
3
votes
3answers
148 views

When websites use SMS as part of a password reset scheme, why do they ask for the user's phone number?

I've noticed if you do a password reset on iCloud, for example, it prompts you for your phone number before sending the SMS. Since many people already know your phone number, or it may be listed ...
2
votes
1answer
215 views

Storing password reset token in DB - what are the implications?

In multiple systems I've built/supported I've seen user management do the following for password reset: generated a password reset token via some hashing method and email the link with token to user. ...
1
vote
2answers
128 views

Is it good to auto log out users after when they change password?

Is it a good practice to implement automatic log-out in an android App after changing the password through the app?
3
votes
2answers
977 views

How long should a password reset token remain valid?

What is the recommended lifetime of a password reset token? Too short will degrade user experience and too long would compromise security. Microsoft identity default to one day but this very long.
3
votes
2answers
111 views

Android Security - Giving Google Your Phone Number

While setting up my Android account on my phone, I am asked If you like, you can add this phone's number to your account .... ..for example you number will be used to: Reset your password ...
2
votes
1answer
351 views

Password Reset URL strategy

Designing a new flow for a "forgot your password" feature we are developing, i came across a challenging question regarding the URL and the commitment that has to be made between frontend and backend ...
0
votes
2answers
131 views

Reseting passwords using IP address

I sent a password reset request, to reset an account of mines and after having some talk with a rep I told him I forgot the email to the account which he told me to just provide the IP address that I ...
8
votes
1answer
316 views

What is a “Cookie Swap” password reset attack?

Am looking over Blackhat appsec trainings and googling. They mention a type of attack for "Password Reset Attacks" known as "Cookie Swap"; see here. While I do not like to make these type of posts I ...
3
votes
1answer
234 views

Is this “forgotten-password” procedure safe/legal?

Recently, I had lost my password on a web app that is supposed to be really secure (think bank or government type web app). This web app contains a lot of personnal critical infos (like SSN and salary,...
2
votes
5answers
171 views

Is it helpful to slow down the password reset function?

I've implemented a password reset function for a website I'm working on. By default, the function is very fast, and I'm wondering if it would be helpful, from a security standpoint, to intentionally ...
0
votes
1answer
202 views

Why would a password reset method be like this? Is it especially safe?

The library of the Technical University in my city (Europe) has a password reset system which I did not encounter anywhere else. Students have to go to some office inside the university to get a new ...
27
votes
10answers
5k views

How to strike a balance between security policies and practical implementation challenges? [duplicate]

At our organization, we came across some frequent incidents such as: Reported successful password guessing attacks Frequent password reset complaints We started an investigation to identify the ...
7
votes
2answers
345 views

Is there value in changing your password after failed (malicious) login attempts?

I just received an email from Citi saying "We've locked your access for 24 hours due to multiple failed login attempts." and "If you didn’t attempt these logins, we recommend that you reset your ...
3
votes
1answer
155 views

Duo Security forgot password workflow

I'm updating my company's forgot password workflow. Currently we use Duo Security as our second factor on login (but for the purposes of my question this can be any such service). I've been walking ...
0
votes
0answers
48 views

Policy for regaining access to a colleague's account

I run a SaaS used by teams to collect company-related information (think something like Crashlytics). Even if the tool lets users invite their colleagues, we often find cases of individuals who ...
50
votes
5answers
10k views

Should I log that a user changed their password?

Are there any security concerns with logging that a user changed their password? I'm already logging whenever an admin changes a users password for audit purposes, but is there a reason to not have a ...
5
votes
2answers
459 views

Should a “password reset” link be valid after changing email?

Here's the scenario: Your account has multiple active “password reset” links out in the world. They expire after 24 hours, and after you change your password. Instead of changing your password, you ...
3
votes
3answers
388 views

Password manager and account recovery

I'd like to start using a password manager, but I'm not sure how to handle account recovery. I'm not a criminal or a secret agent, so if I lose my master password (or my second authentication factor, ...
1
vote
1answer
139 views

self reset password with MFA

I need to implement a reset password feature with Multifactor authorization. The plan is to use these 2 factors: ask a security qs and email/sms a code to the user. I think the order of these should ...
3
votes
1answer
59 views

Providing a SMS recovery feature without compromising the security of an account

I'm designing a system so that it encrypts a user's profiles. The only way of accessing the information stored in it is by either: Providing the password for the account Resetting the password using ...
4
votes
1answer
110 views

If a user changes password should it make all API keys invalid?

When a user changes their password this will force all users who is logged in on the website via cookies to be forced to login again. However, there is a mobile application that logs in the user via ...
2
votes
2answers
133 views

When and why to send an email notification of password reset

The Devise documentation states that "For security purposes, sometimes you need to notify users when their passwords change." In general, when would you need to provide such notification, and why?
2
votes
2answers
194 views

Is it bad to let admins change a users e-mail when resetting passwords?

I'm confused about how to implement password reset functionality. I'm testing a Web application with two roles - administrator and normal user. Only administrators can use the password reset ...
1
vote
0answers
31 views

Asus tablet/laptop [closed]

I need to crack my Asus. My roommate put a password on it and I can't figure it out. The password hint on the login page says crazed. If anybody knows how to get in this M.F. P.O.S. It would be ...
3
votes
1answer
204 views

Convince colleagues that resetting passwords on behalf of users is dangerous

We have a web application which requires users to log in with username and password. We have a password reset feature for users which more or less successfully follows the guidelines outlined by Troy ...
0
votes
1answer
98 views

How do authentication system know if I am reusing a password? How is this secure?

My question is how is it possible to know if I am reusing a password? Are they storing my old password as well [in plaintext]? If an admin had access to the backend, wouldn't they have access to all ...
4
votes
2answers
1k views

Wordpress hacker generating password reset request for admin user

I have received a few password reset emails for the "admin" user (ie login name admin) in an old (but patched up-to-date) Wordpress install. The owner of the site did not request these password ...
4
votes
4answers
370 views

Should users be allowed to reset their password to the current one?

I've been trying to answer the following question but can't seem to find a clear answer... When a user resets their password after forgetting it, should they be allowed to change it to the password ...
-4
votes
5answers
398 views

is my scheme is less secure than the 99% of websites exposed to theses attacks? [closed]

I develop a sort of social network for mobile and desktop browser with a REST API. I can't ask to users to buy a U2F key or any hardware (but I could propose to support it if they have, since Chrome/...
6
votes
1answer
213 views

Alternatives to SMS as a out-of-band channel

I am looking at password reset functionality for a project I am working on. Looking at OWASP guidelines, it suggests using SMS as an out-of-band channel for this. ( https://www.owasp.org/index.php/...
3
votes
1answer
1k views

Best practices for generating and using random timed OTP

Suppose I want to implement an OTP system that generates 6 to 10 digit numbers. (assume its used for reset password, or send money) The OTPs have an expiry time, so they keep getting removed from the ...
1
vote
2answers
74 views

Show if e-mail exists or not [duplicate]

Any security issues showing if a certain e-mail address was found in a database or not when a enduser requests a password-reset on a certain homepage or should the homepage just return some kind of ...
1
vote
5answers
1k views

Using the password hash as a reset token

I had this idea, that instead of generating a password reset token and emailing it to the user, I simply email the user's hashed password to them. Then upon reset, the user would submit the old hashed ...
0
votes
1answer
50 views

Reset Password Link input parameters - where do place?

Which is more recommended? The user security questions are asked before the forgot password reset link is send to email? or Security questions are asked in the page that shows up right after the ...