Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #13064

Re: Most secure way to reset a password via email link

Show all headers | View raw

On Wed, 05 Mar 2014 14:26:21 -0700, Chuck Anderson wrote:
> J.O. Aho wrote:
>> On 05/03/14 14:02, jvd_200089@yahoo.co.uk wrote:
>>
>>> 2) The other way involves sending a link for them to click on that 
>>> redirects them to the password reset page but unless their email
>>> is secure anyone could click that link.
>>
>> Sure, but you could use those really stupid questions like "what was 
>> your mother maiden name" to make it a bit more difficult to just 
>> hijack when someone taken over someone else mail account.
>
> Yes, ... I hate these challenge question schemes. I do not like being 
> forced to share things like my mother's maiden name - or other, perhaps, 
> private information with other people. Do they hash those answers, too? 
> If not, it's like giving away the keys to any other site where I use 
> that. If I pick a random question and supply a random answer, how do I 
> remember it?
>
> I noticed that my answer at one site can be mistyped slightly and still 
> pass. This would imply that they are saving this information in plain 
> text. Stupid is as stupid does.

This is not primary authentication -- it's *typically* designed only to
limit the number of spurious passwords resets you could be deluged with.
Someone has to know enough about you to pass that hurdle to even send a
reset. My own sites use a delay mechanism; only one link to reset an
account password will be generated per day. Miss that link, you'll be
trying again tomorrow instead. (The link mailed is what starts the
invalidation/reset process. Merely having the reset link sent doesn't
affect the account at all, save setting a "reset link request date" that
must be in the past before a new reset link can be sent.) 

> I think this kind of thing (and requirements on password strength) 
> create a security problem of their own by forcing people to record this 
> information somewhere and then keep it handy.

Go ahead and write it down. It's more secure these days to record
passwords only you have access to than it is to NOT record whatever
handful of memorable passwords, even combined with some kind of "mental
hash".

-- 
60. My five-year-old child advisor will also be asked to decipher any 
    code I am thinking of using. If he breaks the code in under 30 
    seconds, it will not be used. Note: this also applies to passwords.
	--Peter Anspach's list of things to do as an Evil Overlord

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Most secure way to reset a password via email link jvd_200089@yahoo.co.uk - 2014-03-05 05:02 -0800
  Re: Most secure way to reset a password via email link Jerry Stuckle <jstucklex@attglobal.net> - 2014-03-05 08:49 -0500
  Re: Most secure way to reset a password via email link Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-03-05 14:56 +0000
    Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-05 15:35 +0000
      Re: Most secure way to reset a password via email link jvd_200089@yahoo.co.uk - 2014-03-05 07:54 -0800
        Re: Most secure way to reset a password via email link Gregor Kofler <usenet@gregorkofler.com> - 2014-03-05 17:34 +0100
          Re: Most secure way to reset a password via email link Arno Welzel <usenet@arnowelzel.de> - 2014-03-19 17:05 +0100
        Re: Most secure way to reset a password via email link Denis McMahon <denismfmcmahon@gmail.com> - 2014-03-05 19:51 +0000
          Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-05 21:47 +0000
    Re: Most secure way to reset a password via email link Christoph Michael Becker <cmbecker69@arcor.de> - 2014-03-05 17:29 +0100
  Re: Most secure way to reset a password via email link "J.O. Aho" <user@example.net> - 2014-03-05 18:53 +0100
    Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-05 14:26 -0700
      Re: Most secure way to reset a password via email link "Peter H. Coffin" <hellsop@ninehells.com> - 2014-03-05 16:44 -0600
      Re: Most secure way to reset a password via email link Richard Yates <richard@yatesguitar.com> - 2014-03-05 15:51 -0800
        Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-06 00:12 +0000
          Re: Most secure way to reset a password via email link Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-03-06 11:30 +1100
            Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-06 00:58 +0000
              Re: Most secure way to reset a password via email link Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-03-06 13:38 +1100
              Re: Most secure way to reset a password via email link Arno Welzel <usenet@arnowelzel.de> - 2014-03-19 17:08 +0100
            Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-05 21:13 -0700
              Re: Most secure way to reset a password via email link Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-03-06 16:17 +1100
                Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-06 22:53 -0700
      Re: Most secure way to reset a password via email link gordonb.9e9ri@burditt.org (Gordon Burditt) - 2014-03-29 01:28 -0500
  Re: Most secure way to reset a password via email link jnorth.au@example.com - 2014-03-06 13:58 +1100
    Re: Most secure way to reset a password via email link Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-03-06 03:32 +0000
      Re: Most secure way to reset a password via email link jnorth.au@example.com - 2014-03-07 12:41 +1100
        Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-06 22:55 -0700
          Re: Most secure way to reset a password via email link jnorth.au@example.com - 2014-03-07 18:45 +1100
    Re: Most secure way to reset a password via email link jvd_200089@yahoo.co.uk - 2014-03-06 05:35 -0800
  Re: Most secure way to reset a password via email link Arno Welzel <usenet@arnowelzel.de> - 2014-03-19 17:01 +0100

csiph-web