All Questions
6 questions
0
votes
4
answers
364
views
Forget Me Not? Abandoning the Forgot Password Functionality
They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it ...
- 151
2
votes
0
answers
204
views
Admin able to set new plaintext user password - security problem?
I am working on this application that can be deployed and run by anyone on their server. Most often, it is run as a web service. In our new version, we removed the possibility for admins to set and ...
- 63
2
votes
3
answers
1k
views
Password reset vs change
My webapp has "password reset" and "password change" functionality.
Password "reset" is typical: user clicks "I forgot my password", enters his email, one-time link emailed there, he visits a form to ...
- 455
2
votes
1
answer
204
views
Secure password reset before authentication?
I have recently been considering the password reset flow for a site I'm working on. A request came up that before authentication, a user should have an option to change their password by providing:
...
- 89
7
votes
4
answers
2k
views
Should users be allowed to reset their password to the current one?
I've been trying to answer the following question but can't seem to find a clear answer...
When a user resets their password after forgetting it, should they be allowed to change it to the password ...
- 801
3
votes
1
answer
491
views
Purpose of having a identifier on a password reset communication
A particular service I use, when asked for a password reset, showed me an identifier on the website - something like 4562708546, apparently random or sequential.
They then sent me a new password over ...
- 5,468