Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [password-reset]

The tag has no usage guidance.

0
votes
2answers
73 views

Account Recovery: Displaying username without verification

I'm not a security guy, so bear with me. As discussed in other topics, usernames in and of themselves are valid forms of verification, and there's nothing particularly sensitive or secure about ...
2
votes
1answer
90 views

Secure password reset before authentication?

I have recently been considering the password reset flow for a site I'm working on. A request came up that before authentication, a user should have an option to change their password by providing: ...
4
votes
3answers
154 views

How to reset passwords without emailed reset link?

In an offline system what is the preferred method of resetting a user's password? Usually this would be handled with an emailed password reset link. However this system is offline, there is no access ...
1
vote
2answers
125 views

When you enable 2FA, why is your second factor required to reset password?

In a conversation with a coworker the other day, I had trouble successfully defending why, when you enable 2FA on a service, you're required to enter a second factor before changing your password (in, ...
3
votes
3answers
131 views

When websites use SMS as part of a password reset scheme, why do they ask for the user's phone number?

I've noticed if you do a password reset on iCloud, for example, it prompts you for your phone number before sending the SMS. Since many people already know your phone number, or it may be listed ...
2
votes
1answer
84 views

Storing password reset token in DB - what are the implications?

In multiple systems I've built/supported I've seen user management do the following for password reset: generated a password reset token via some hashing method and email the link with token to user. ...
1
vote
2answers
98 views

Is it good to auto log out users after when they change password?

Is it a good practice to implement automatic log-out in an android App after changing the password through the app?
2
votes
2answers
256 views

How long should a password reset token remain valid?

What is the recommended lifetime of a password reset token? Too short will degrade user experience and too long would compromise security. Microsoft identity default to one day but this very long.
3
votes
2answers
103 views

Android Security - Giving Google Your Phone Number

While setting up my Android account on my phone, I am asked If you like, you can add this phone's number to your account .... ..for example you number will be used to: Reset your password ...
1
vote
0answers
52 views

Password Reset URL strategy

Designing a new flow for a "forgot your password" feature we are developing, i came across a challenging question regarding the URL and the commitment that has to be made between frontend and backend ...
0
votes
2answers
83 views

Reseting passwords using IP address

I sent a password reset request, to reset an account of mines and after having some talk with a rep I told him I forgot the email to the account which he told me to just provide the IP address that I ...
8
votes
1answer
265 views

What is a “Cookie Swap” password reset attack?

Am looking over Blackhat appsec trainings and googling. They mention a type of attack for "Password Reset Attacks" known as "Cookie Swap"; see here. While I do not like to make these type of posts I ...
3
votes
1answer
211 views

Is this “forgotten-password” procedure safe/legal?

Recently, I had lost my password on a web app that is supposed to be really secure (think bank or government type web app). This web app contains a lot of personnal critical infos (like SSN and salary,...
0
votes
0answers
45 views

Is it helpful to slow down password reset function

I've implemented a password reset function for a website I'm working on. By default, the function is very fast, and I'm wondering if it would be helpful, from a security standpoint, to intentionally ...
0
votes
1answer
196 views

Why would a password reset method be like this? Is it especially safe?

The library of the Technical University in my city (Europe) has a password reset system which I did not encounter anywhere else. Students have to go to some office inside the university to get a new ...
27
votes
10answers
5k views

How to strike a balance between security policies and practical implementation challenges? [duplicate]

At our organization, we came across some frequent incidents such as: Reported successful password guessing attacks Frequent password reset complaints We started an investigation to identify the ...
7
votes
2answers
314 views

Is there value in changing your password after failed (malicious) login attempts?

I just received an email from Citi saying "We've locked your access for 24 hours due to multiple failed login attempts." and "If you didn’t attempt these logins, we recommend that you reset your ...
3
votes
1answer
108 views

Duo Security forgot password workflow

I'm updating my company's forgot password workflow. Currently we use Duo Security as our second factor on login (but for the purposes of my question this can be any such service). I've been walking ...
0
votes
0answers
46 views

Policy for regaining access to a colleague's account

I run a SaaS used by teams to collect company-related information (think something like Crashlytics). Even if the tool lets users invite their colleagues, we often find cases of individuals who ...
50
votes
5answers
10k views

Should I log that a user changed their password?

Are there any security concerns with logging that a user changed their password? I'm already logging whenever an admin changes a users password for audit purposes, but is there a reason to not have a ...
5
votes
2answers
287 views

Should a “password reset” link be valid after changing email?

Here's the scenario: Your account has multiple active “password reset” links out in the world. They expire after 24 hours, and after you change your password. Instead of changing your password, you ...
3
votes
3answers
255 views

Password manager and account recovery

I'd like to start using a password manager, but I'm not sure how to handle account recovery. I'm not a criminal or a secret agent, so if I lose my master password (or my second authentication factor, ...
1
vote
1answer
70 views

self reset password with MFA

I need to implement a reset password feature with Multifactor authorization. The plan is to use these 2 factors: ask a security qs and email/sms a code to the user. I think the order of these should ...
3
votes
1answer
47 views

Providing a SMS recovery feature without compromising the security of an account

I'm designing a system so that it encrypts a user's profiles. The only way of accessing the information stored in it is by either: Providing the password for the account Resetting the password using ...
4
votes
1answer
103 views

If a user changes password should it make all API keys invalid?

When a user changes their password this will force all users who is logged in on the website via cookies to be forced to login again. However, there is a mobile application that logs in the user via ...
2
votes
2answers
100 views

When and why to send an email notification of password reset

The Devise documentation states that "For security purposes, sometimes you need to notify users when their passwords change." In general, when would you need to provide such notification, and why?
2
votes
2answers
187 views

Is it bad to let admins change a users e-mail when resetting passwords?

I'm confused about how to implement password reset functionality. I'm testing a Web application with two roles - administrator and normal user. Only administrators can use the password reset ...
1
vote
0answers
30 views

Asus tablet/laptop [closed]

I need to crack my Asus. My roommate put a password on it and I can't figure it out. The password hint on the login page says crazed. If anybody knows how to get in this M.F. P.O.S. It would be ...
3
votes
1answer
195 views

Convince colleagues that resetting passwords on behalf of users is dangerous

We have a web application which requires users to log in with username and password. We have a password reset feature for users which more or less successfully follows the guidelines outlined by Troy ...
0
votes
1answer
92 views

How do authentication system know if I am reusing a password? How is this secure?

My question is how is it possible to know if I am reusing a password? Are they storing my old password as well [in plaintext]? If an admin had access to the backend, wouldn't they have access to all ...
4
votes
2answers
762 views

Wordpress hacker generating password reset request for admin user

I have received a few password reset emails for the "admin" user (ie login name admin) in an old (but patched up-to-date) Wordpress install. The owner of the site did not request these password ...
4
votes
4answers
336 views

Should users be allowed to reset their password to the current one?

I've been trying to answer the following question but can't seem to find a clear answer... When a user resets their password after forgetting it, should they be allowed to change it to the password ...
-4
votes
5answers
384 views

is my scheme is less secure than the 99% of websites exposed to theses attacks? [closed]

I develop a sort of social network for mobile and desktop browser with a REST API. I can't ask to users to buy a U2F key or any hardware (but I could propose to support it if they have, since Chrome/...
6
votes
1answer
189 views

Alternatives to SMS as a out-of-band channel

I am looking at password reset functionality for a project I am working on. Looking at OWASP guidelines, it suggests using SMS as an out-of-band channel for this. ( https://www.owasp.org/index.php/...
3
votes
1answer
1k views

Best practices for generating and using random timed OTP

Suppose I want to implement an OTP system that generates 6 to 10 digit numbers. (assume its used for reset password, or send money) The OTPs have an expiry time, so they keep getting removed from the ...
1
vote
2answers
63 views

Show if e-mail exists or not [duplicate]

Any security issues showing if a certain e-mail address was found in a database or not when a enduser requests a password-reset on a certain homepage or should the homepage just return some kind of ...
1
vote
5answers
892 views

Using the password hash as a reset token

I had this idea, that instead of generating a password reset token and emailing it to the user, I simply email the user's hashed password to them. Then upon reset, the user would submit the old hashed ...
0
votes
1answer
41 views

Reset Password Link input parameters - where do place?

Which is more recommended? The user security questions are asked before the forgot password reset link is send to email? or Security questions are asked in the page that shows up right after the ...
3
votes
1answer
509 views

How disable “last password you remember” of Google, after knowing that someone has my password?

I have received this email from Google: Someone just used your password to try to sign in to your Google Account xxxxxx@gmail.com. Details: Sunday, July 9, 2017 11:27 AM (France Time) *****...
3
votes
3answers
139 views

How to reset account passwords after falling victim to password reuse?

I recently had one of my accounts compromised after falling victim to an online phishing scam. To make matters worse, while I've used unique passwords for any account created in the past few years, my ...
7
votes
1answer
627 views

If my phone for two factor authentication is stolen, can the attacker access my account via an email password reset?

Suppose I setup an online account with 2FA on my phone, and an attacker gains access to my phone. My phone is logged into my email account. The attacker knows my online service's account username or ...
1
vote
1answer
80 views

Benefits of Facebooks new “Trusted Friends” feature

Today on my Facebook I saw a new (to me at least) feature to access your account if you lose access somehow. The process is simple. You add 3 to 5 friends as trusted friends. Then if you lose access ...
0
votes
1answer
73 views

Is it secure for a user to manually reset his password on every login when OTP isn't forced?

Is it secure for a user to manually reset his password every login (via email or 2 factor authentication) to a random token via email or 2 factor authentication, when OTP isn't forced ? I mean an ...
0
votes
3answers
640 views

My router got hacked, do I need to reset all 9 devices in my house?

My router got hacked. And people suggest that the best way is to factory reset the router, then reset all the devices using the network. I'm getting a new router so the reset router part is solved. ...
0
votes
3answers
158 views

Password reset mail - reset password again [duplicate]

Let's assume this situation: I am a user of an online shop, I forgot my password. So I use the functionality of this online shop to reset my password. The online shop sends me an email with a link I ...
3
votes
1answer
403 views

ASP NET Core Identity password reset form prompts for email address

I notice that the default ASP.NET Core Identity templates ask for email address after the reset email notification link has been followed (i.e. the "choose a new password" form in the ResetPassword....
8
votes
3answers
1k views

Forgot your password: “New password must have a minimum of 4 characters different from the previous password” [duplicate]

This was found on a password reset feature of a government website, where you enter your username, then it takes you to a screen where you can enter a new password enter confirmation of new password ...
3
votes
1answer
57 views

Should we confirm other personal details before security questions during password resets?

I've been tasked to work on a password reset tool for my company website. This tool is for a support person to provide a new reset password over the phone in case the customer does not receive the ...
104
votes
5answers
21k views

How can waiting 24 hours to change the password again be secure?

So I managed to change my password on a service to the "wrong" password, for simplicity let's just say I changed it to an insecure password. Now, I wanted to change it to a more secure password but ...
7
votes
1answer
2k views

one-time JWT token with JWT ID claim

I'm trying to figure out how to issue a one-time use JWT token for password reset feature and still keeping it stateless. Came across Single-Use Tokens w/ JWT which basically suggests to include hash ...