Skip to main content

All Questions

Filter by
Sorted by
Tagged with
0 votes
4 answers
364 views

Forget Me Not? Abandoning the Forgot Password Functionality

They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it ...
Bradford Griggs's user avatar
2 votes
0 answers
204 views

Admin able to set new plaintext user password - security problem?

I am working on this application that can be deployed and run by anyone on their server. Most often, it is run as a web service. In our new version, we removed the possibility for admins to set and ...
Chimarr's user avatar
  • 63
2 votes
3 answers
1k views

Password reset vs change

My webapp has "password reset" and "password change" functionality. Password "reset" is typical: user clicks "I forgot my password", enters his email, one-time link emailed there, he visits a form to ...
lonix's user avatar
  • 455
2 votes
1 answer
204 views

Secure password reset before authentication?

I have recently been considering the password reset flow for a site I'm working on. A request came up that before authentication, a user should have an option to change their password by providing: ...
Frostbyte's user avatar
7 votes
4 answers
2k views

Should users be allowed to reset their password to the current one?

I've been trying to answer the following question but can't seem to find a clear answer... When a user resets their password after forgetting it, should they be allowed to change it to the password ...
SameOldNick's user avatar
3 votes
1 answer
491 views

Purpose of having a identifier on a password reset communication

A particular service I use, when asked for a password reset, showed me an identifier on the website - something like 4562708546, apparently random or sequential. They then sent me a new password over ...
watchowl's user avatar
  • 5,468