Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder1.news.weretis.net!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Arno Welzel Newsgroups: comp.lang.php Subject: Re: Most secure way to reset a password via email link Date: Wed, 19 Mar 2014 17:05:46 +0100 Lines: 24 Message-ID: <5329C05A.8070309@arnowelzel.de> References: <0.7c6306525de79ca69666.20140305145614GMT.87siqw8zjl.fsf@bsb.me.uk> <6a00bdfc-d14b-4518-8476-76b19fe35dc9@googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Trace: individual.net rTSJeqNW4ZmQwVjNNUZlJA8ucDQWiCdwrr2jqV1DBIs0C9EKq0 Cancel-Lock: sha1:iNRU7xrOzcHDxX6GgvqqPKqh08s= User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 In-Reply-To: Xref: csiph.com comp.lang.php:13217 Am 05.03.2014 17:34, schrieb Gregor Kofler: > Am 05.03.2014 16:54, jvd_200089@yahoo.co.uk meinte: >> On Wednesday, 5 March 2014 15:35:30 UTC, The Natural Philosopher wrote: >>> Then always use https to avoid man in the middle attacks >> >> Yes, email link will point to https:// but when using SSL what wrong with just redisplaying the password on the screen (after answer further security questions) because the data sent between server and client will by encrypted whereas an email to a standard pop3 email account won't be (or can you send SLL to a standard email)? > > TLS will encrypt mails. Provided by practically all contemporary mail > servers and clients. TLS will not encrypt mails. TLS is "Transport Layer Security" - it will only encrypt the connection between the client and the server. But there is no guarantee that this applies to all smarthots on the way from your server to the clients (ISP) server. Mail encryption would be nice - but so far I don't know any service who offers to use a public PGP key or S/MIME certificate to send encrypted mails to their customers. -- Arno Welzel http://arnowelzel.de http://de-rec-fahrrad.de