131 votes
Accepted

How can waiting 24 hours to change the password again be secure?

By itself, the rule of only allowing one password change per day adds no security. But it often comes in addition to another rule that says that the new password must be different from the n (...
Serge Ballesta's user avatar
100 votes

Password reset giving clues of possible valid email addresses

Don't indicate that the attempt "failed". A user (legitimate or otherwise), asks for a password reset link, and gives you an email address. All you should say here is along the lines of Your ...
yoozer8's user avatar
  • 806
86 votes

Are security flaws acceptable if not much harm can derive from them?

Yes. This is a problem - a big problem. Lately I found a design flaw in a business' webshop that allowed me to insert innocent notes in other visitors' charts. Seems innocent, and only annoying, ...
O'Niel's user avatar
  • 2,904
78 votes
Accepted

How to implement “forgot password” functionality?

Use HTTPS only for this, and then we'll get onto details of implementation. First of all you're going to want to protect against user enumeration. That is, don't reveal in the page whether the user ...
SilverlightFox's user avatar
62 votes
Accepted

Ability To Change Root User Password (Vulnerability?)

You pretty much hit the nail on the head when you said that you need physical access to the machine. If you have physical access, you don't need to go through the official steps to reset the root ...
Ghedipunk's user avatar
  • 6,050
61 votes
Accepted

Are security flaws acceptable if not much harm can derive from them?

Your question is: Are security flaws acceptable if no much harm can derive from them? The answer is yes, if decided by business while understanding the consequences. What you are doing is called a ...
WoJ's user avatar
  • 9,018
52 votes
Accepted

Should I log that a user changed their password?

To, answer your question, Yes, you can and SHOULD log password-changes, and there's nothing fundamentally wrong with doing so, as long as you don't e.g. record the password itself" What to log? When ...
Shane Andrie's user avatar
  • 3,840
52 votes
Accepted

Where should I store a username during a password reset?

This is what I usually do: The user asks for a password reset. The system asks for the registered email. The user enters email, and no matter if email exists or not, you say that you sent a reset ...
ThoriumBR's user avatar
  • 53.9k
45 votes

How do I reset passwords on multiple websites easily?

This is a known problem without an existing solution. Some password management tools are working on it, but it is not complete or fool-proof. For example: https://helpdesk.lastpass.com/generating-a-...
schroeder's user avatar
  • 129k
42 votes
Accepted

How to strike a balance between security policies and practical implementation challenges?

Since this question is not a technical one, rather more about human behaviour, you won't get the answer. What you describe is very typical though and I made the same experience. Complex password ...
martinstoeckli's user avatar
36 votes
Accepted

How do I reset passwords on multiple websites easily?

No, not really - they all have different processes for verifying your identity for password reset requests, and there isn't any standard for bulk password resets. For example, Apple may use a device ...
Matthew's user avatar
  • 27.4k
34 votes
Accepted

Why does Windows not always force me to confirm my password when changing it?

In addition to what nobody said there's a more practical, but mostly internal, requirement here. Changing a local password in Windows without knowing the original password is called a reset. Resets ...
Steve's user avatar
  • 15.3k
34 votes
Accepted

Pros & cons of including requesting IP address in password reset emails?

if you're putting someone else's email into a reset process, do you have any real expectation of privacy? This statement is based on the idea that putting someone else's email into a reset process is ...
schroeder's user avatar
  • 129k
32 votes

Are security flaws acceptable if not much harm can derive from them?

The problem that I see with such a simple password reset scheme is that it suggests further vulnerabilities in the platform. A flawed concept of security is rarely so isolated as to only happen once, ...
phyrfox's user avatar
  • 5,744
30 votes

Password reset giving clues of possible valid email addresses

The reason for this finding is that a user gets different responses, depending on the existence of the email address. This can be as simple as telling them that the address is not known, or something ...
Demento's user avatar
  • 7,465
30 votes
Accepted

How does password reset work if 2FA is enabled?

Technically, this is a question about how you should implement 2FA (or how you should expect it to be implemented), since there's nothing inherent in 2FA that answers your questions in either ...
CBHacking's user avatar
  • 47.6k
28 votes

Ability To Change Root User Password (Vulnerability?)

How is this not a glaring security vulnerability? It is. Physical access to your system is the ultimate vulnerability. Is there a way to disable this 'feature' so that it cannot be changed from ...
DevSolar's user avatar
  • 911
25 votes

How can waiting 24 hours to change the password again be secure?

Other answers have covered possible security benefits, however one significant drawback occurs to me: if an attacker takes control of an account and changes the password, they are guaranteed a minimum ...
user371366's user avatar
23 votes

Password reset giving clues of possible valid email addresses

What are we protecting against? First of all one should ask what they are protecting against exactly. In this case there are two different threats: Threat 1 An attacker brute forces random emails to ...
David Mulder's user avatar
  • 1,368
20 votes

Password reset giving clues of possible valid email addresses

As an addition to the answers above (Would be better suited as a comment but can't do that yet) another step the hacker can take is to measure the TIME of your response to the form. It might take you ...
Michael P's user avatar
  • 311
18 votes

How to implement “forgot password” functionality?

Your line of thinking is on the right track. However, I would suggest describing the flow for your forgotten password functionality from one step earlier. Somebody claims to have forgotten their ...
Jacco's user avatar
  • 7,662
16 votes

Are security flaws acceptable if not much harm can derive from them?

If I see this scenario right, they can change E-Mail address and password of any account, then start a repair-form and continue the repair-process via mail. The support team will probably assume that ...
Falco's user avatar
  • 1,502
16 votes

Where should I store a username during a password reset?

You should not trust the client. So if the client is able to send their username during the stage where the new password is entered, what happens if they change the username to someone else's? They ...
multithr3at3d's user avatar
15 votes

is my scheme is less secure than the 99% of websites exposed to theses attacks?

No, this is a steaming mess. In fact it would be a misnomer to even call this 2FA. Really what you've done is eliminate one of the factors and this is closer to side channel authentication than two ...
Caleb's user avatar
  • 1,324
14 votes

Sending password reset links in email

Send a unique string of text, a.k.a. a token (cryptographically secure, randomly generated), to the user via some other band besides e-mail, such as SMS or even snail mail. They can change their ...
vrtjason's user avatar
  • 1,125
14 votes

How to strike a balance between security policies and practical implementation challenges?

The best solution is to train your user base to use passphrases. Passphrases are easier to remember, easier to type - and harder to crack. And the NIST rules that @martinstoeckli mentioned are ...
Royce Williams's user avatar
14 votes
Accepted

How to properly create a password reset token?

Password reset tokens aren't very much like passwords. They're short-lived, single-use, and - most relevantly here - machine generated and non-memorable. You absolutely must use a cryptographically ...
CBHacking's user avatar
  • 47.6k
13 votes

Pros & cons of including requesting IP address in password reset emails?

The intention being that if someone is receiving unexpected reset emails, this allows them to do a basic level of investigation I would question whether a full IP address is the best solution to this ...
Gh0stFish's user avatar
  • 10.1k
12 votes

Should I let users pick their own secret questions for password reset?

Basically, people are rubbish at coming up with questions. They come up with things like "Type 'secret'" or "My name" - they're worthless at best, and actively harmful at worst ("Usual password" - the ...
Matthew's user avatar
  • 27.4k
12 votes
Accepted

If my phone for two factor authentication is stolen, can the attacker access my account via an email password reset?

As @Limit pointed out in the comment under your question, the attacker would first need to unlock your phone. Which is a problem. But not impossible. But for the sake of argument, let's assume the ...
Nalaurien's user avatar
  • 1,654

Only top scored, non community-wiki answers of a minimum length are eligible