Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #13216

Re: Most secure way to reset a password via email link

Show all headers | View raw

Am 05.03.2014 14:02, schrieb jvd_200089@yahoo.co.uk:

> When resetting a password:
> 
> 1) Emailing a new password that the user then logs in with and resets
> is the most simple method for non hashed passwords.

Even for hashed ones, since it is always possible to generate a password
to send and the hash for it on the server.

> 2) The other way involves sending a link for them to click on that
> redirects them to the password reset page but unless their email is
> secure anyone could click that link. What is special about this 2nd
> way? because thats what how my boss wants it to work because there is
> not point doing it that way if it isn't  more secure than sending
> them a temporary new password.

There is no difference between the two ways concerning security.

*Every* e-mail is not secure as long as the transmission is not
encrypted. It doesn't matter if the mail contains a new password or a
link. If the attacker gets access to the mail and also knows the account
associated with, he will get access to the account.

> Also any source code examples for option 2 would be appreciated.

I don't have code - just the way to do it:

Set a flag in the user account that it is "locked" and the user must set
a new password and can not use the old one any longer. Then send an
e-mail with the URL where the user can enter a new password.


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

Back to comp.lang.php | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Most secure way to reset a password via email link jvd_200089@yahoo.co.uk - 2014-03-05 05:02 -0800
  Re: Most secure way to reset a password via email link Jerry Stuckle <jstucklex@attglobal.net> - 2014-03-05 08:49 -0500
  Re: Most secure way to reset a password via email link Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-03-05 14:56 +0000
    Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-05 15:35 +0000
      Re: Most secure way to reset a password via email link jvd_200089@yahoo.co.uk - 2014-03-05 07:54 -0800
        Re: Most secure way to reset a password via email link Gregor Kofler <usenet@gregorkofler.com> - 2014-03-05 17:34 +0100
          Re: Most secure way to reset a password via email link Arno Welzel <usenet@arnowelzel.de> - 2014-03-19 17:05 +0100
        Re: Most secure way to reset a password via email link Denis McMahon <denismfmcmahon@gmail.com> - 2014-03-05 19:51 +0000
          Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-05 21:47 +0000
    Re: Most secure way to reset a password via email link Christoph Michael Becker <cmbecker69@arcor.de> - 2014-03-05 17:29 +0100
  Re: Most secure way to reset a password via email link "J.O. Aho" <user@example.net> - 2014-03-05 18:53 +0100
    Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-05 14:26 -0700
      Re: Most secure way to reset a password via email link "Peter H. Coffin" <hellsop@ninehells.com> - 2014-03-05 16:44 -0600
      Re: Most secure way to reset a password via email link Richard Yates <richard@yatesguitar.com> - 2014-03-05 15:51 -0800
        Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-06 00:12 +0000
          Re: Most secure way to reset a password via email link Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-03-06 11:30 +1100
            Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-06 00:58 +0000
              Re: Most secure way to reset a password via email link Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-03-06 13:38 +1100
              Re: Most secure way to reset a password via email link Arno Welzel <usenet@arnowelzel.de> - 2014-03-19 17:08 +0100
            Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-05 21:13 -0700
              Re: Most secure way to reset a password via email link Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-03-06 16:17 +1100
                Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-06 22:53 -0700
      Re: Most secure way to reset a password via email link gordonb.9e9ri@burditt.org (Gordon Burditt) - 2014-03-29 01:28 -0500
  Re: Most secure way to reset a password via email link jnorth.au@example.com - 2014-03-06 13:58 +1100
    Re: Most secure way to reset a password via email link Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-03-06 03:32 +0000
      Re: Most secure way to reset a password via email link jnorth.au@example.com - 2014-03-07 12:41 +1100
        Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-06 22:55 -0700
          Re: Most secure way to reset a password via email link jnorth.au@example.com - 2014-03-07 18:45 +1100
    Re: Most secure way to reset a password via email link jvd_200089@yahoo.co.uk - 2014-03-06 05:35 -0800
  Re: Most secure way to reset a password via email link Arno Welzel <usenet@arnowelzel.de> - 2014-03-19 17:01 +0100

csiph-web