Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #13080

Re: Most secure way to reset a password via email link

Show all headers | View raw

jnorth.au@example.com wrote:
> On Thu, 06 Mar 2014 03:32:17 +0000, Ben Bacarisse <ben.usenet@bsb.me.uk> wrote:
>
>   
>> jnorth.au@example.com writes:
>>
>>     
>>> On Wed, 5 Mar 2014 05:02:50 -0800 (PST), jvd_200089@yahoo.co.uk wrote:
>>>
>>>       
>>>> When resetting a password:
>>>> 1) Emailing a new password that the user then logs in with and resets
>>>> is the most simple method for non hashed passwords.
>>>>
>>>> 2) The other way involves sending a link for them to click on that
>>>> redirects them to the password reset page but unless their email is
>>>> secure anyone could click that link. What is special about this 2nd
>>>> way? because thats what how my boss wants it to work because there is
>>>> not point doing it that way if it isn't more secure than sending them
>>>> a temporary new password.
>>>>
>>>> Also any source code examples for option 2 would be appreciated.
>>>>         
>>> Another method which you might want to consider is:
>>> Sending an email stating that the next time they login they will need
>>> to reset their password.
>>>
>>> In the database and the user table have a field that will indicate
>>> whether or not the password needs to be reset.
>>>
>>> If a reset is required then redirect them to the change password file.
>>>
>>> This way their is no 'confidential' information being sent via email.
>>>       
>> I think the OP is talking about a situation where the user can't log in
>> any more and has requested a "reset".  If the user can't log in,
>> allowing them to change their password is not a safe option!
>>     
>
> I agree but the simple method of using only username/email and password is never going to be secure.
> While the OP's second method is a bit more secure there are still problems. How do you know, with
> any certainty that this is the person who is responding the the email?
>
> Using email address as a username is not a good idea as these can be easily guessed.
>
> To achieve more certainty of the person requesting a password reset would be to set up some
> challenge questions (which the user set up when first registering). If they pass those then you are
> probably dealing with the right person.
>   

Isn't "what's your email address?" the equivalent of a challenge question?

-- 
*****************************
 Chuck Anderson • Boulder, CO
  http://cycletourist.com
 Turn Off, Tune Out, Drop In
*****************************

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Most secure way to reset a password via email link jvd_200089@yahoo.co.uk - 2014-03-05 05:02 -0800
  Re: Most secure way to reset a password via email link Jerry Stuckle <jstucklex@attglobal.net> - 2014-03-05 08:49 -0500
  Re: Most secure way to reset a password via email link Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-03-05 14:56 +0000
    Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-05 15:35 +0000
      Re: Most secure way to reset a password via email link jvd_200089@yahoo.co.uk - 2014-03-05 07:54 -0800
        Re: Most secure way to reset a password via email link Gregor Kofler <usenet@gregorkofler.com> - 2014-03-05 17:34 +0100
          Re: Most secure way to reset a password via email link Arno Welzel <usenet@arnowelzel.de> - 2014-03-19 17:05 +0100
        Re: Most secure way to reset a password via email link Denis McMahon <denismfmcmahon@gmail.com> - 2014-03-05 19:51 +0000
          Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-05 21:47 +0000
    Re: Most secure way to reset a password via email link Christoph Michael Becker <cmbecker69@arcor.de> - 2014-03-05 17:29 +0100
  Re: Most secure way to reset a password via email link "J.O. Aho" <user@example.net> - 2014-03-05 18:53 +0100
    Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-05 14:26 -0700
      Re: Most secure way to reset a password via email link "Peter H. Coffin" <hellsop@ninehells.com> - 2014-03-05 16:44 -0600
      Re: Most secure way to reset a password via email link Richard Yates <richard@yatesguitar.com> - 2014-03-05 15:51 -0800
        Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-06 00:12 +0000
          Re: Most secure way to reset a password via email link Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-03-06 11:30 +1100
            Re: Most secure way to reset a password via email link The Natural Philosopher <tnp@invalid.invalid> - 2014-03-06 00:58 +0000
              Re: Most secure way to reset a password via email link Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-03-06 13:38 +1100
              Re: Most secure way to reset a password via email link Arno Welzel <usenet@arnowelzel.de> - 2014-03-19 17:08 +0100
            Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-05 21:13 -0700
              Re: Most secure way to reset a password via email link Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-03-06 16:17 +1100
                Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-06 22:53 -0700
      Re: Most secure way to reset a password via email link gordonb.9e9ri@burditt.org (Gordon Burditt) - 2014-03-29 01:28 -0500
  Re: Most secure way to reset a password via email link jnorth.au@example.com - 2014-03-06 13:58 +1100
    Re: Most secure way to reset a password via email link Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-03-06 03:32 +0000
      Re: Most secure way to reset a password via email link jnorth.au@example.com - 2014-03-07 12:41 +1100
        Re: Most secure way to reset a password via email link Chuck Anderson <cycletourist@invalid.invalid> - 2014-03-06 22:55 -0700
          Re: Most secure way to reset a password via email link jnorth.au@example.com - 2014-03-07 18:45 +1100
    Re: Most secure way to reset a password via email link jvd_200089@yahoo.co.uk - 2014-03-06 05:35 -0800
  Re: Most secure way to reset a password via email link Arno Welzel <usenet@arnowelzel.de> - 2014-03-19 17:01 +0100

csiph-web