130 votes
Accepted

How can waiting 24 hours to change the password again be secure?

By itself, the rule of only allowing one password change per day adds no security. But it often comes in addition to another rule that says that the new password must be different from the n (...
107 votes
Accepted

Why should you redirect the user to a login page after a password reset?

Lets say an attacker has your password. You log in and reset it. If the reset doesn't invalidate all existing sessions, the attacker still has access, as long as they don't let their session expire. ...
  • 1,565
101 votes

Password reset giving clues of possible valid email addresses

Don't indicate that the attempt "failed". A user (legitimate or otherwise), asks for a password reset link, and gives you an email address. All you should say here is along the lines of Your ...
  • 810
86 votes

Are security flaws acceptable if not much harm can derive from them?

Yes. This is a problem - a big problem. Lately I found a design flaw in a business' webshop that allowed me to insert innocent notes in other visitors' charts. Seems innocent, and only annoying, ...
  • 2,740
77 votes
Accepted

How to implement “forgot password” functionality?

Use HTTPS only for this, and then we'll get onto details of implementation. First of all you're going to want to protect against user enumeration. That is, don't reveal in the page whether the user ...
62 votes
Accepted

Ability To Change Root User Password (Vulnerability?)

You pretty much hit the nail on the head when you said that you need physical access to the machine. If you have physical access, you don't need to go through the official steps to reset the root ...
  • 5,776
61 votes
Accepted

Are security flaws acceptable if not much harm can derive from them?

Your question is: Are security flaws acceptable if no much harm can derive from them? The answer is yes, if decided by business while understanding the consequences. What you are doing is called a ...
  • 8,957
52 votes
Accepted

Should I log that a user changed their password?

To, answer your question, Yes, you can and SHOULD log password-changes, and there's nothing fundamentally wrong with doing so, as long as you don't e.g. record the password itself" What to log? When ...
  • 3,780
52 votes
Accepted

Where should I store a username during a password reset?

This is what I usually do: The user asks for a password reset. The system asks for the registered email. The user enters email, and no matter if email exists or not, you say that you sent a reset ...
  • 50.7k
45 votes

How do I reset passwords on multiple websites easily?

This is a known problem without an existing solution. Some password management tools are working on it, but it is not complete or fool-proof. For example: https://helpdesk.lastpass.com/generating-a-...
  • 124k
44 votes

Why should you redirect the user to a login page after a password reset?

Protecting sessions on possibly compromised account There is no need to actually redirect to the login page if session management upon password change is done securely. That is, as long as all ...
42 votes
Accepted

How to strike a balance between security policies and practical implementation challenges?

Since this question is not a technical one, rather more about human behaviour, you won't get the answer. What you describe is very typical though and I made the same experience. Complex password ...
35 votes

Why should you redirect the user to a login page after a password reset?

The other answers are probably more correct from a netsec perspective, but I wanted to add that you also get to make sure that the user is actually able to log in with their new password. This makes ...
35 votes
Accepted

How do I reset passwords on multiple websites easily?

No, not really - they all have different processes for verifying your identity for password reset requests, and there isn't any standard for bulk password resets. For example, Apple may use a device ...
  • 27.2k
34 votes
Accepted

Why does Windows not always force me to confirm my password when changing it?

In addition to what nobody said there's a more practical, but mostly internal, requirement here. Changing a local password in Windows without knowing the original password is called a reset. Resets ...
  • 15.2k
32 votes

Password reset giving clues of possible valid email addresses

The reason for this finding is that a user gets different responses, depending on the existence of the email address. This can be as simple as telling them that the address is not known, or something ...
  • 7,259
31 votes
Accepted

Should password reset tokens be hashed when stored in a database?

Yes, you should hash password reset tokens, exactly for the reasons you mentioned. But no, it's not quite as bad as unhashed passwords, because reset tokens expire and not every user has an active ...
  • 29.1k
31 votes

Are security flaws acceptable if not much harm can derive from them?

The problem that I see with such a simple password reset scheme is that it suggests further vulnerabilities in the platform. A flawed concept of security is rarely so isolated as to only happen once, ...
  • 5,724
29 votes
Accepted

How does password reset work if 2FA is enabled?

Technically, this is a question about how you should implement 2FA (or how you should expect it to be implemented), since there's nothing inherent in 2FA that answers your questions in either ...
  • 40.5k
28 votes

Ability To Change Root User Password (Vulnerability?)

How is this not a glaring security vulnerability? It is. Physical access to your system is the ultimate vulnerability. Is there a way to disable this 'feature' so that it cannot be changed from ...
  • 911
24 votes

How can waiting 24 hours to change the password again be secure?

Other answers have covered possible security benefits, however one significant drawback occurs to me: if an attacker takes control of an account and changes the password, they are guaranteed a minimum ...
23 votes

Should password reset tokens be hashed when stored in a database?

No, there is no overwhelming need to hash password reset tokens, as long as they are time-limited and single-use. There's some benefit to hashing reset tokens, but the benefit is less than with ...
  • 98.4k
21 votes

Password reset giving clues of possible valid email addresses

What are we protecting against? First of all one should ask what they are protecting against exactly. In this case there are two different threats: Threat 1 An attacker brute forces random emails to ...
  • 1,349
20 votes

Password reset giving clues of possible valid email addresses

As an addition to the answers above (Would be better suited as a comment but can't do that yet) another step the hacker can take is to measure the TIME of your response to the form. It might take you ...
  • 311
18 votes

How to implement “forgot password” functionality?

Your line of thinking is on the right track. However, I would suggest describing the flow for your forgotten password functionality from one step earlier. Somebody claims to have forgotten their ...
  • 7,412
16 votes

Are security flaws acceptable if not much harm can derive from them?

If I see this scenario right, they can change E-Mail address and password of any account, then start a repair-form and continue the repair-process via mail. The support team will probably assume that ...
  • 1,493
16 votes

Where should I store a username during a password reset?

You should not trust the client. So if the client is able to send their username during the stage where the new password is entered, what happens if they change the username to someone else's? They ...
15 votes

is my scheme is less secure than the 99% of websites exposed to theses attacks?

No, this is a steaming mess. In fact it would be a misnomer to even call this 2FA. Really what you've done is eliminate one of the factors and this is closer to side channel authentication than two ...
  • 1,334
14 votes

Sending password reset links in email

Send a unique string of text, a.k.a. a token (cryptographically secure, randomly generated), to the user via some other band besides e-mail, such as SMS or even snail mail. They can change their ...
  • 1,045
14 votes

How to strike a balance between security policies and practical implementation challenges?

The best solution is to train your user base to use passphrases. Passphrases are easier to remember, easier to type - and harder to crack. And the NIST rules that @martinstoeckli mentioned are ...

Only top scored, non community-wiki answers of a minimum length are eligible