102

Don't indicate that the attempt "failed". A user (legitimate or otherwise), asks for a password reset link, and gives you an email address. All you should say here is along the lines of Your submissions has been received. If we have an account matching your email address, you will receive an email with a link to reset your password. The user will still ...


52

This is what I usually do: The user asks for a password reset. The system asks for the registered email. The user enters email, and no matter if email exists or not, you say that you sent a reset link. The server stores email, expiration and reset token on a reset_password table When the link is accessed, expiration is checked and a form to reset the ...


34

In addition to what nobody said there's a more practical, but mostly internal, requirement here. Changing a local password in Windows without knowing the original password is called a reset. Resets cause DPAPI keys to be invalidated (because they're protected by a primary secret based on the user password). Once the reset happens those original keys are dead ...


32

The reason for this finding is that a user gets different responses, depending on the existence of the email address. This can be as simple as telling them that the address is not known, or something more subtle in the response. The easiest implementation to avoid this kind of problem is giving back the exact same response, no matter whether the email ...


26

Technically, this is a question about how you should implement 2FA (or how you should expect it to be implemented), since there's nothing inherent in 2FA that answers your questions in either direction. With that said, there are certainly best practices. 2FA (or multi-factor authentication in general) should apply whenever the user is being asked to prove ...


20

As an addition to the answers above (Would be better suited as a comment but can't do that yet) another step the hacker can take is to measure the TIME of your response to the form. It might take you 10ms to determine the email doesn't exists, while it takes you 100ms to generate a reset link and send an email. The hacker can know if the response is slower ...


20

What are we protecting against? First of all one should ask what they are protecting against exactly. In this case there are two different threats: Threat 1 An attacker brute forces random emails to find valid registered emails. This could be theoretically used to create spam lists, but as far as I know has never been done as it's simpler to just sent the ...


16

You should not trust the client. So if the client is able to send their username during the stage where the new password is entered, what happens if they change the username to someone else's? They will be able to reset the account of another user and take over the account. @ThoriumBR's answer is of course correct. Another option is to store no state on the ...


13

Changing the password from command line requires an elevated command prompt (i.e. administrative privileges). Normal users cannot do this. This makes sense since the admin should be able to change the password of any user. If, however, you have left your computer logged in as an admin user then having your password reset by the intruder would be the least of ...


8

You should weigh up the problem versus the inconvenience of solution. It's often a tradeoff. In my opinion it is usually better to sacrifice this bit of security for the sake of user experience unless someone might get persecuted for being registered in your site. From time to time I come years later to a site and try to find which email did I use for the ...


5

To add to ThoriumBR's excellent response: user asks for a password reset system asks for the registered email user enters email, and no matter if email exists or not, you say that you sent a reset link but does not reset the password yet server stores email, expiration and reset token on a reset_password table when the link is accessed… server checks ...


3

Hacker's often test password recovery systems for possible account enumeration weaknesses. Though a bad design decision or misconfiguration, a password recovery can reveal the existance of a user account. Then a list of valid user accounts can be used later in a brute force attack. An attacker may test if there are different responses for valid and invalid ...


3

Sending user name has no sense. On the server side you store information which password reset token is related to which user. When user clicks on the link, you know exactly what user it is. You obtain user name based on the token and display it in the password reset form.


2

Based on your description, biometric and username/password appear to be independent authentication factors (option A). That is, if either one of them can be used to sign in and one factor is enough, then you should keep them independent for the recovery/reset process. Resetting a factor (password or biometric) should not impact the other factor. User ...


2

This is not as secure as one might want it to be: Assume an attacker visits a site and pretends to be some user of that site and to have fogotten the password. On the password reset page they can pre-enter the desired future password and a mail to the real owner of the account is sent. The real owner receives the mail and perhaps clicks the link because ...


1

We can't know how Unsplash detected it unless they tell us. However, many large websites have some sort of abuse tooling to automatically detect patterns. For example, Unsplash may import compromised credentials from public databases and match logins on those accounts from certain shared IP addresses. Clearly they've seen this pattern before since they ...


1

As you are comparing the token with what you saved in the current browser session, you don't need to use <entered_email + timestamp + random> in the token. Just the random suffices. So you basically store in the browser session: User id to be reset Reset token Timestamp it was sent or token expiry When you receive the link, you: Allow to reset the ...


1

To reset a password is an authenticated operation and requires that the user has identified themselves in a secure manner. Usually it is done with a user name and password plus a second factor. The user name and password are often submitted at the same time in the same HTTP request. This is not uncommon and is not a red flag. In a forgotten password scenario,...


1

I would like to understand what the attacker is trying to achieve in order to evaluate if this is a threat. From the points you listed, the symptoms points to DOS attack. Try captcha (only a suggestion: google recaptcha v3) as a means of protection against BOT based resource consumption attacks for web facing tech. Why would he send password requests for ...


1

Does this mean that reflected xss can't be achieved here? The xss can not be achieved here because the context of outbound encoding(URL encoding) is correct which means URL encoding is applied to data reflecting in the URL and as owasp suggests, the outbound encoding is one of the solution for XSS vulnerability. CSP and xss auditors in browser also plays a ...


1

Passwords are something you know, biometrics are something you are, and using both is consider multi-factor authentication have to [sign in with username and password] in many scenarios, if for instance your fingerprints on the device were updated If you have a requirement that states the user need to utilize something you know (the weakest factor) to ...


1

If i'm not wrong, 2FA has to be manually disabled, it will not be voided with a change of password. Some sites/applications might require 2FA to change the password. So you have to look at the attacker POV on how to disable 2FA. Disabling 2FA varies from sites to sites. For example, cryptocurrency sites requires manual identification like a video or a ...


1

From my experience, it is always recommended to have all identity-based operations in one place. In your use case it is AuthN service which manages the identity. I would also adice to taking a look into biggest gamers on this market: Google Account, MS Azure AD, GitHub, Twitter. If you have application which uses those identity providers to authenticate ...


1

The password reset scheme you describe looks OK, but you are leaving several questions unanswered at point 7, which are relevant for evaluation: What happens, if the token the user submitted is wrong? How many tries do you give the user before considering the reset attempt failed and block further token submissions? If a reset attempt failed, can a user ...


1

Note that this also (besides the other answers) applies to the registration screen, instead of complaining about already registered user sent them an email that they are already registered and provide no feedback about this in the web app besides "check your mail". This is best done if you ask for minimum input on the first step before the email validation (...


1

Receiving a plain text password (That the user must change upon login) and receive a link with a token it's the same, as long as they meet security policies that are not attached to any type by its own. Some good policies are: Time based expiration of the temporary password or token. Complex and random generated passwords/token (Not guessable, based on user'...


1

I an not sure how to directly exploit the Password reset links but the link pattern can be definitely used for Phishing campaigns. However for temporary passwords I feel that their strength depends on how guessable they are and how strong the password generating algorithm is. If they are random like OTP, there might be issue of randomness.


1

Password Policies A password policy cannot be created in a vacuum, it must be derived from the Security Policy & Process of the Organization. Usually, this is called the ISMS, or Information Security Management System. In the general case, it will consist of a variety of policy documents addressing different aspects of information security. For ...


1

Let me try to answer this question. In general, it is the role of the business owners to have up to date inventory of all assets, to decide on critical assets and to prioritize the importance of before any further business impact analysis and action related to security (confidentiality, integrity, accessibility) happens. One could classify assets and data ...


Only top voted, non community-wiki answers of a minimum length are eligible