Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder1.news.weretis.net!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Arno Welzel Newsgroups: comp.lang.php Subject: Re: Most secure way to reset a password via email link Date: Wed, 19 Mar 2014 17:01:23 +0100 Lines: 37 Message-ID: <5329BF53.4030800@arnowelzel.de> References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Trace: individual.net h2QUnZ8FCeL3tiuYwuCyBQEId8PXUDRXA9WaFNgRJpVzImcfKw Cancel-Lock: sha1:vlKCoECPIAyIISYhA2H6JeuFpFk= User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 In-Reply-To: Xref: csiph.com comp.lang.php:13216 Am 05.03.2014 14:02, schrieb jvd_200089@yahoo.co.uk: > When resetting a password: > > 1) Emailing a new password that the user then logs in with and resets > is the most simple method for non hashed passwords. Even for hashed ones, since it is always possible to generate a password to send and the hash for it on the server. > 2) The other way involves sending a link for them to click on that > redirects them to the password reset page but unless their email is > secure anyone could click that link. What is special about this 2nd > way? because thats what how my boss wants it to work because there is > not point doing it that way if it isn't more secure than sending > them a temporary new password. There is no difference between the two ways concerning security. *Every* e-mail is not secure as long as the transmission is not encrypted. It doesn't matter if the mail contains a new password or a link. If the attacker gets access to the mail and also knows the account associated with, he will get access to the account. > Also any source code examples for option 2 would be appreciated. I don't have code - just the way to do it: Set a flag in the user account that it is "locked" and the user must set a new password and can not use the old one any longer. Then send an e-mail with the URL where the user can enter a new password. -- Arno Welzel http://arnowelzel.de http://de-rec-fahrrad.de