All Questions
Tagged with passwords password-reset
6 questions
108
votes
5
answers
40k
views
How can waiting 24 hours to change the password again be secure?
So I managed to change my password on a service to the "wrong" password, for simplicity let's just say I changed it to an insecure password.
Now, I wanted to change it to a more secure password but ...
- 948
91
votes
9
answers
23k
views
Why should you redirect the user to a login page after a password reset?
The OWASP Forgot Password Cheat Sheet suggests:
Whenever a successful password reset occurs, the session should be invalidated and the user redirected to the login page
I'm failing to understand ...
- 953
47
votes
3
answers
18k
views
Should password reset tokens be hashed when stored in a database?
Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in.
If I can get a valid password reset token ...
- 1,177
16
votes
4
answers
7k
views
Why are one time password reset links safer than one time passwords?
Recently I applied for a job at a company creating
security-critical solutions for military, aerospace, ...
After registering at their webpage, I received an email with my username and a ...
- 337
14
votes
2
answers
13k
views
How does password reset work if 2FA is enabled?
(There is a highly related question, however I believe mine is not a duplicate, since it deals with resetting a password without access to the account, not changing it while being logged in.)
Say ...
- 333
1
vote
3
answers
344
views
Are there any security advantages to forcing a password-character limit on reset, but allowing unlimited character in password-login?
I was resetting a password a few moments ago, and I was given a character limit of around 10 characters to make a secure password with.
After resetting the password, I went to enter my password, and ...
- 907