Collaborate Disseminate
I have recently been considering the password reset flow for a site I’m working on. A request came up that before authentication, a user should have an option to change their password by providing:
Username
Current Password… Continue reading Secure password reset before authentication?
In an offline system what is the preferred method of resetting a user’s password?
Usually this would be handled with an emailed password reset link. However this system is offline, there is no access to email.
My first thou… Continue reading How to set reset passwords without emailed reset link?
Photography website 500px has become the latest site to admit suffering a serious data breach. Continue reading Photography site 500px resets 14.8 million passwords after data breach
The decorating website said that account usernames, passwords and more have been compromised as part of a breach. Continue reading Houzz Urges Password Resets After Data Breach
In a conversation with a coworker the other day, I had trouble successfully defending why, when you enable 2FA on a service, you’re required to enter a second factor before changing your password (in, say, a “lost password” f… Continue reading When you enable 2FA, why is your second factor required to reset password?
In a conversation with a coworker the other day, I had trouble successfully defending why, when you enable 2FA on a service, you’re required to enter a second factor before changing your password (in, say, a “lost password” f… Continue reading When you enable 2FA, why is your second factor required to reset password?
I’ve noticed if you do a password reset on iCloud, for example, it prompts you for your phone number before sending the SMS.
Since many people already know your phone number, or it may be listed publicly somewhere, why do we… Continue reading When websites use SMS as part of a password reset scheme, why do they ask for the user’s phone number?
Flaws in the mobile site were leaving users vulnerable to attackers who could have reset their user passwords and hijacked their accounts. Continue reading Samsung fixes flaws that could have let attackers hijack your account
Flaws in the mobile site were leaving users vulnerable to attackers who could have reset their user passwords and hijacked their accounts. Continue reading Samsung fixes flaws that could have let attackers hijack your account
In multiple systems I’ve built/supported I’ve seen user management do the following for password reset: generated a password reset token via some hashing method and email the link with token to user. Usually there are bits of… Continue reading Storing password reset token in DB – what are the implications?