Printable View
i'm in the process of designing a webapp with a login with password section. i want to have a password retrieval option for user who have lost/forgotten...
so...what y'all think is the best, least insecure way to go about this...
1) answer "hint question" and display pwd in browser or secure browser
2) enter sign up email and auto email pwd...
3) ????
i know that these both have risks....but given users are going to forget...i have to deal with it...
I dont think answering hint question is good thing because many people has their questions like - What is my name or something like this so for everyone would be easy to got to their account. And people who dont have so stupid question sometimes forgot the answers:) (I do it really often - I give there so hard question that later I'm not sure what is the correct answer:)) Email - this is also not without any problems but IMO better than question. And because I have no other idea how to do that I think you should use email...
Have a nice day, sun7dots
Hard question to answer. :)Quote:
Originally posted here by zigar
i'm in the process of designing a webapp with a login with password section. i want to have a password retrieval option for user who have lost/forgotten...
so...what y'all think is the best, least insecure way to go about this...
1) answer "hint question" and display pwd in browser or secure browser
2) enter sign up email and auto email pwd...
3) ????
i know that these both have risks....but given users are going to forget...i have to deal with it...
I think perhaps #1, with https
require them to use pgp. Then, when they sign up, they give you their public key. When they need their password, you send it to them encrypted, so even if someone does fool the system into sending out another users password, they still need the users private key to get it.
email them anew strong password. Yeah, and using PGP is a good thing. But it shouldn't be a requirement.
pgp would be great...except most of my users are not what you'd call tech savvy....and 30% of my users are from aol...pgp???....huh???...is that my new screen name???....pretty good popcorn???...i typed pgp in the password box and it didn't work....???
i expect i'll use the email new pwd option....i'll send them a good one...so they can know what a good one is before they log in and change it to "bob"...or "mypassword"
or may be the both, first answer "hint question" and if they answer right then send the password ( WITHOUT THE USER ID) to the mail. Also you should tell the users to not submit fake mail.
One other suggestion...
Limit the choices they have for their hint questions. Pick 5-10 good questions that are a little more secure than "What's my name" and then make them pick one of those and answer it. Then when they come back, all they have to do is once again pick the question and supply the correct answer. This makes it slightly harder for people trying to break the system because they have to guess which question the person picked as well as the correct answer.
DNA analysis, can't fake or hack that one. Have them mail you a tube of their blood, everyone knows how to give blood it is easy just slice wrist lay back in tub.......
Force them to use their social security number has hint answer :D
Log that in a database for further use! :D
Nah joking... I think Unleashed has the soundest idea so far...
How many users do you think you will have? Is manual password recovery a possibility?
Phonecall directly to you would be the best choice if you have time and will to do it...
Well, bar'ing a "secure way" to do this, I'd say to mail them a new, strong password... as long as you have "verified" their email address (I think AO does this sort of thing, too).
1. User chooses new id
2. If UserID exists, rinse and repeat (though this is a brute-forceable user list problem)
3. Mail them a strong password / link to verify email
4. They login and set their password
...if they forget the password, start at step # 3, first WARNING them you were going to mail it and, as others have said, don't include the userid.
In any case, if their mail bounces, lock the account until verification can be (re)established.
For "advanced" users, you can do PGP (using their KeyID on a public key server). If they lose that key, though... things get more interesting.
Hold their firstborn child as proof and if they need it reset ask the kid which one of these people are your mommy or daddy...can't go wrong there....
sorry butt end of 12 hour night shift where 1:25 is actually 6:30 am
Combination of Unleashed and str34m3r. Have them choose from a list of questions going in, then give their answer. If they forget they have to choose the same question and give the same answer. However, I'd just take them to the new (or present) pwd on a secure page instead of emailing it to them. Reason: a person can secure their 'puter with a bios pwd that most friends can't reset to use the machine if they did have access, but their 'friends' can pirate their email pwd pretty easy. Just MHO.