Re: Most secure way to reset a password via email link

From	"J.O. Aho" <user@example.net>
Newsgroups	comp.lang.php
Subject	Re: Most secure way to reset a password via email link
Date	2014-03-05 18:53 +0100
Message-ID	<bnp6k7Fqg4gU1@mid.individual.net> (permalink)
References	<dd08a623-1882-412f-bb6f-c5c6bfe409e7@googlegroups.com>

Show all headers | View raw

On 05/03/14 14:02, jvd_200089@yahoo.co.uk wrote:
> When resetting a password:
> 1) Emailing a new password that the user then logs in with and resets is the most simple method for non hashed passwords.

Then the password is stored in plain text, even if the user who resets 
the password is the owner of the account, someone who gets access to the 
mail account will be able to get hold of the password (how many don't 
keep those emails with passwords, just in case they would forget it).
There is also the risk of quite many being able to read the password 
without access to the email account on it's way from the systems mail 
system to the account owners mail account.

This is bad as Christoph already pointed with his link to OWASP.

> 2) The other way involves sending a link for them to click on that redirects them to the password reset page but unless their email
> is secure anyone could click that link.

Sure, but you could use those really stupid questions like "what was 
your mother maiden name" to make it a bit more difficult to just hijack 
when someone taken over someone else mail account.

> What is special about this 2nd way? because thats what how my boss wants it to work because there is not point doing it that way if it isn't
> more secure than sending them a temporary new password.

You have the less risk of storing the password in plain text, no one at 
your company will be able to get hold of account passwords and as the 
user will for sure set a password and more likely to remember it.

> Also any source code examples for option 2 would be appreciated.

I think you can manage to solve it by yourself, just sit down five 
minutes and think where to store the random generated string which is 
part of the url.

-- 

  //Aho

Thread

Most secure way to reset a password via email link jvd_200089@yahoo.co.uk - 2014-03-05 05:02 -0800
  Re: Most secure way to reset a password via email link Jerry Stuckle <jstucklex@attglobal.net> - 2014-03-05 08:49 -0500
  Re: Most secure way to reset a password via email link Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-03-05 14:56 +0000
    Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-05 15:35 +0000
      Re: Most secure way to reset a password via email link jvd_200089@yahoo.co.uk - 2014-03-05 07:54 -0800
        Re: Most secure way to reset a password via email link Gregor Kofler <usenet@gregorkofler.com> - 2014-03-05 17:34 +0100
          Re: Most secure way to reset a password via email link Arno Welzel <usenet@arnowelzel.de> - 2014-03-19 17:05 +0100
        Re: Most secure way to reset a password via email link Denis McMahon <denismfmcmahon@gmail.com> - 2014-03-05 19:51 +0000
          Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-05 21:47 +0000
    Re: Most secure way to reset a password via email link Christoph Michael Becker <cmbecker69@arcor.de> - 2014-03-05 17:29 +0100
  Re: Most secure way to reset a password via email link "J.O. Aho" <user@example.net> - 2014-03-05 18:53 +0100
    Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-05 14:26 -0700
      Re: Most secure way to reset a password via email link "Peter H. Coffin" <hellsop@ninehells.com> - 2014-03-05 16:44 -0600
      Re: Most secure way to reset a password via email link Richard Yates <richard@yatesguitar.com> - 2014-03-05 15:51 -0800
        Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-06 00:12 +0000
          Re: Most secure way to reset a password via email link Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-03-06 11:30 +1100
            Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-06 00:58 +0000
              Re: Most secure way to reset a password via email link Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-03-06 13:38 +1100
              Re: Most secure way to reset a password via email link Arno Welzel <usenet@arnowelzel.de> - 2014-03-19 17:08 +0100
            Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-05 21:13 -0700
              Re: Most secure way to reset a password via email link Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-03-06 16:17 +1100
                Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-06 22:53 -0700
      Re: Most secure way to reset a password via email link gordonb.9e9ri@burditt.org (Gordon Burditt) - 2014-03-29 01:28 -0500
  Re: Most secure way to reset a password via email link jnorth.au@example.com - 2014-03-06 13:58 +1100
    Re: Most secure way to reset a password via email link Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-03-06 03:32 +0000
      Re: Most secure way to reset a password via email link jnorth.au@example.com - 2014-03-07 12:41 +1100
        Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-06 22:55 -0700
          Re: Most secure way to reset a password via email link jnorth.au@example.com - 2014-03-07 18:45 +1100
    Re: Most secure way to reset a password via email link jvd_200089@yahoo.co.uk - 2014-03-06 05:35 -0800
  Re: Most secure way to reset a password via email link Arno Welzel <usenet@arnowelzel.de> - 2014-03-19 17:01 +0100

csiph-web