3 ms·
> But nerdery aside, unless I'm missing it, this piece seems to be lacking one of the most important controls for password resets: > Invalidate reset records a
by CiPHPerCoder 10y ago
> But nerdery aside, unless I'm missing it, this piece seems to be lacking one of the most important controls for password resets:
> Invalidate reset records after use, after any password change, and after a fixed (short) amount of time.
That was (somewhat implicitly) covered in the "what incumbent systems" do: https://paragonie.com/blog/2016/09/untangling-forget-me-knot-secure-account-recovery-made-simple#secure-password-reset-tokens https://paragonie.com/blog/2016/09/untangling-forget-me-knot...
Since you mention it, I'll make that a separate list item. It's important enough to risk being repetitive about.
- tptacek 10y agoI don't see it anywhere. You should make it very explicit, since it's a mistake lots of systems make. There are popular applications where you can use password reset emails over and over again. I would say the first most important attribute of a password reset scheme is that it not be based on weak secondary passwords like "Mother's maiden name". The second most important attribute of a password reset scheme is that it be based on a simple lookup of a random token, and not elaborate encryption schemes, since those schemes tend to cough up game-over auth bypass bugs. The third post important attribute of a password reset scheme is that they be single-use and rigorously invalidated, so that your application isn't spewing hazmat over people's email spools.
- CiPHPerCoder 10y agoOkay, I've made it explicit. https://paragonie.com/blog/2016/09/untangling-forget-me-knot-secure-account-recovery-made-simple#expire-tokens https://paragonie.com/blog/2016/09/untangling-forget-me-knot...