All Questions
Tagged with passwords password-reset
50 questions
0
votes
1
answer
125
views
Strange way of handling forgotten password
I was about to signup for ebanking solution, but then noticed their instructions for forgotten password are: Create a new account.
So there's no option to reset your password, just a suggestion to ...
- 103
0
votes
0
answers
109
views
How could one use multi-factor authentication to derive a static secret key?
Scenario:
The setup is that each user has a randomly generated key A used for encrypting data stored on the server and a password-derived key B used to store A on the server without the server getting ...
- 647
3
votes
4
answers
430
views
When resetting password after forgetting it, why is there a need to notify "Password cannot be your previous password"?
This is from the perspective of someone who had supposedly forgotten their password. We're doing this project wherein we "secure" an application that was given to us. We added this "...
- 31
0
votes
3
answers
304
views
Send password reset email after too many failed logins versus X minutes of lock out
Some sites lock me out for a while after too many failed attempts.
For our own site, we want to force a password reset email after X amount of failed attempts. After all, if your email is compromised, ...
- 549
0
votes
4
answers
364
views
Forget Me Not? Abandoning the Forgot Password Functionality
They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it ...
- 151
2
votes
2
answers
1k
views
Why should password reset link be single use?
Reading from here: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html
It mentioned that password reset link should be single use and expire after appropriate period. I don'...
- 121
2
votes
1
answer
2k
views
Allowing a password reset if an account is locked
Similar to another question about keeping an account locked, is it preferable to allow a user to reset their password while the account is locked out due to the wrong password being used too many ...
- 123
1
vote
1
answer
219
views
How do sites detect credential sniffing, and what is the purpose of this attack?
I just got an email from the Unsplash service telling me that someone had logged into my account via credential sniffing:
Five minutes later I get three more emails, each one notifying that a (...
- 979
18
votes
1
answer
5k
views
Why does Windows not always force me to confirm my password when changing it?
If I can change my password with cmd net user example * without needing to confirm my old password, why, when I change my password in the usual way (via settings or control panel), do I need to ...
- 183
1
vote
3
answers
3k
views
What is the best practice for resetting multi-factor when a user requests to recover their password?
I am in the process of developing a web-application which requires MFA on every login. (On the first login, before you can do anything, you are forced to setup MFA. Due to monetary restrictions and ...
- 9
14
votes
2
answers
13k
views
How does password reset work if 2FA is enabled?
(There is a highly related question, however I believe mine is not a duplicate, since it deals with resetting a password without access to the account, not changing it while being logged in.)
Say ...
- 333
2
votes
2
answers
2k
views
Where should 'reset password' functionality be?
We've recently overhauled the backend to our mobile app from having a very basic authentication mechanism that went through the API to having both an authentication server and an API server, with the ...
- 346
3
votes
1
answer
2k
views
Implications of a 6 digit password reset token
I'm designing a password reset system for my website/app right now and I'm not sure if the solution that I've reached could be considered suitably secure. The steps for resetting a password are as ...
- 33
2
votes
0
answers
204
views
Admin able to set new plaintext user password - security problem?
I am working on this application that can be deployed and run by anyone on their server. Most often, it is run as a web service. In our new version, we removed the possibility for admins to set and ...
- 63
0
votes
0
answers
28
views
How to approach a site that doesn't manage passwords correctly? [duplicate]
I am registered to a site which doesn't manage password correctly. It is a user area for a company that provides services of some sort and which uses the area to show details of the contracts and for ...
- 123
2
votes
3
answers
1k
views
Password reset vs change
My webapp has "password reset" and "password change" functionality.
Password "reset" is typical: user clicks "I forgot my password", enters his email, one-time link emailed there, he visits a form to ...
- 455
24
votes
4
answers
25k
views
How to properly create a password reset token?
I searched for a long time, and never really find any articles or posts that fully explain how a password reset token should be created.
What I know so far:
It should be random.
Its hash should be ...
- 342
2
votes
1
answer
204
views
Secure password reset before authentication?
I have recently been considering the password reset flow for a site I'm working on. A request came up that before authentication, a user should have an option to change their password by providing:
...
- 89
9
votes
2
answers
5k
views
How long should a password reset token remain valid?
What is the recommended lifetime of a password reset token?
Too short will degrade user experience and too long would compromise security.
Microsoft identity default to one day but this very long.
- 193
0
votes
2
answers
1k
views
Reseting passwords using IP address
I sent a password reset request, to reset an account of mines and after having some talk with a rep I told him I forgot the email to the account which he told me to just provide the IP address that I ...
- 2,127
26
votes
10
answers
6k
views
How to strike a balance between security policies and practical implementation challenges? [duplicate]
At our organization, we came across some frequent incidents such as:
Reported successful password guessing attacks
Frequent password reset complaints
We started an investigation to identify the ...
- 2,037
9
votes
2
answers
2k
views
Is there value in changing your password after failed (malicious) login attempts?
I just received an email from Citi saying "We've locked your access for 24 hours due to multiple failed login attempts." and "If you didn’t attempt these logins, we recommend that you reset your ...
48
votes
5
answers
11k
views
Should I log that a user changed their password?
Are there any security concerns with logging that a user changed their password? I'm already logging whenever an admin changes a users password for audit purposes, but is there a reason to not have a ...
- 561
5
votes
2
answers
1k
views
Should a "password reset" link be valid after changing email?
Here's the scenario:
Your account has multiple active “password reset” links out in the world. They expire after 24 hours, and after you change your password.
Instead of changing your password, you ...
- 153
3
votes
3
answers
1k
views
Password manager and account recovery
I'd like to start using a password manager, but I'm not sure how to handle account recovery.
I'm not a criminal or a secret agent, so if I lose my master password (or my second authentication factor, ...
- 183
4
votes
1
answer
1k
views
If a user changes password should it make all API keys invalid?
When a user changes their password this will force all users who is logged in on the website via cookies to be forced to login again. However, there is a mobile application that logs in the user via ...
- 249
3
votes
2
answers
843
views
When and why to send an email notification of password reset
The Devise documentation states that "For security purposes, sometimes you need to notify users when their passwords change." In general, when would you need to provide such notification, and why?
- 223
1
vote
0
answers
101
views
Asus tablet/laptop [closed]
I need to crack my Asus. My roommate put a password on it and I can't figure it out. The password hint on the login page says crazed. If anybody knows how to get in this M.F. P.O.S. It would be ...
- 11
7
votes
4
answers
2k
views
Should users be allowed to reset their password to the current one?
I've been trying to answer the following question but can't seem to find a clear answer...
When a user resets their password after forgetting it, should they be allowed to change it to the password ...
- 801
2
votes
5
answers
2k
views
Using the password hash as a reset token
I had this idea, that instead of generating a password reset token and emailing it to the user, I simply email the user's hashed password to them. Then upon reset, the user would submit the old hashed ...
- 222
5
votes
1
answer
2k
views
How disable "last password you remember" of Google, after knowing that someone has my password?
I have received this email from Google:
Someone just used your password to try to sign in to your Google Account [email protected].
Details:
Sunday, July 9, 2017 11:27 AM (France Time)
*****...
- 151
2
votes
3
answers
249
views
How to reset account passwords after falling victim to password reuse?
I recently had one of my accounts compromised after falling victim to an online phishing scam. To make matters worse, while I've used unique passwords for any account created in the past few years, my ...
- 1,535
6
votes
3
answers
4k
views
Forgot your password: "New password must have a minimum of 4 characters different from the previous password" [duplicate]
This was found on a password reset feature of a government website, where you enter your username, then it takes you to a screen where you can
enter a new password
enter confirmation of new password
...
- 163
108
votes
5
answers
40k
views
How can waiting 24 hours to change the password again be secure?
So I managed to change my password on a service to the "wrong" password, for simplicity let's just say I changed it to an insecure password.
Now, I wanted to change it to a more secure password but ...
- 948
1
vote
2
answers
225
views
Password-Changing Password
I want to create a public (password given out to everyone) gmail account that anyone can use (for subscriptions, using useful websites that require your real email but spam you, etc.) and that's the ...
0
votes
1
answer
165
views
Steps to secure an account where an attacker keeps resetting the password [closed]
I have an account on a major company website that has for some reason fallen under attack. Periodically over the course of the day I will get a text message from the company saying your password has ...
- 918
16
votes
4
answers
7k
views
Why are one time password reset links safer than one time passwords?
Recently I applied for a job at a company creating
security-critical solutions for military, aerospace, ...
After registering at their webpage, I received an email with my username and a ...
- 337
2
votes
6
answers
1k
views
Password reset - Cryptographically signed user ID and timestamp or randomly generated value?
What are the pros and cons of the different ways of handling reset links?
I see two ways of handling them:
Generate a random string, for example with uuid4. Store it in the database with the user and ...
4
votes
3
answers
2k
views
Should password reset link expire when clicked, or wait until reset is filled out and completed?
Im implementing a password recovery solution that follows this Generic Framework convention:
https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Insufficient_Password_Recovery#...
- 143
1
vote
2
answers
1k
views
Active Directory "Forgot password" feature without email or text
We're currently looking to implement a secure AD password self-reset feature for our users. Our scenario is to manage people who forgot their password, not those who want to change it. Our users are ...
- 2,758
1
vote
1
answer
844
views
How does Password reset key work ?
I mean, this looks like a really handy tool for every IT guy out there. But to me, it seems like it does not do anything really hard other than just simplyfing something you can do yourself.
So what ...
- 792
3
votes
1
answer
11k
views
Why must new password must be different from old
When changning my password ive come across this below message a few times:
Your new password must be different from your previous password.
What is the rationale behind such implementation?
EDIT:
...
- 131
1
vote
3
answers
344
views
Are there any security advantages to forcing a password-character limit on reset, but allowing unlimited character in password-login?
I was resetting a password a few moments ago, and I was given a character limit of around 10 characters to make a secure password with.
After resetting the password, I went to enter my password, and ...
- 907
1
vote
3
answers
394
views
Is it secure to send a password recovery link for company application to an employee's personal email address?
I would like to automate the recovery of the password for the employees of a company. However, the problem is that not every employee has a corporate email account and some employees can't access ...
- 1,497
3
votes
1
answer
491
views
Purpose of having a identifier on a password reset communication
A particular service I use, when asked for a password reset, showed me an identifier on the website - something like 4562708546, apparently random or sequential.
They then sent me a new password over ...
- 5,468
91
votes
9
answers
23k
views
Why should you redirect the user to a login page after a password reset?
The OWASP Forgot Password Cheat Sheet suggests:
Whenever a successful password reset occurs, the session should be invalidated and the user redirected to the login page
I'm failing to understand ...
- 953
8
votes
6
answers
2k
views
Forgot password and revealing whether account exists [duplicate]
So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets;
Notify the user whether or not the ...
47
votes
3
answers
18k
views
Should password reset tokens be hashed when stored in a database?
Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in.
If I can get a valid password reset token ...
- 1,177
3
votes
5
answers
1k
views
What if user can't answer the security question during password reset?
I'm thinking out my password recovery logic for an ecommerce system. Some backround: Passwords are stored using bcrypt, password recovery involves the standard reset link, which then can be used to ...
- 133
10
votes
2
answers
3k
views
Is there a risk in sending the username in a password reset email?
We're using a CMS that has a password reset function that works according to best practices out of the box.
Passwords are stored as salted hashes
Forgot Password works like this:
User enters ...
- 2,716