4 ms·

Btw I always thought emailing a password back is just a habit from the past emerged with thousands of quick-n-dirty php apps in late 90s and this meme is copie

by kunley 16y ago

Btw I always thought emailing a password back is just a habit from the past emerged with thousands of quick-n-dirty php apps in late 90s and this meme is copied till today "because others do it", and surely it's not any thoughtful application workflow. What exactly do you have in mind telling this is dependent on the nature of the application? What type of applications should encourage it? Just curious.

rlpb 16y ago
What about in the case of a password reset request? Ultimately there has to be some mechanism for a password reset, and there must be some level authentication during this reset. How about a non-security-sensitive website which has a registration function and the only form of contact is via the registered email address? Users are likely to forget their passwords. The only way to verify a user in order to reset his password is with his email address. If you reset the password on request and then email it, then there is effectively a DoS there, and you are requiring the user to take extra effort (going back in and changing it again). If you email the existing plaintext password to him on request, then there is no DoS issue and minimal hassle for the user - provided that the security requirements make it acceptable for 1) a plaintext password to be emailed (but otherwise what else are you going to do?) and 2) the old password to be continued to be used even after it has been emailed in plaintext. I'm not sure which of the two options I would implement myself. I'm not even aware of what existing webapps do since I use a password safe and so have never had to go through the process. I'm just saying that for a non-security-sensitive situation, I have no major objection to the second option being used, and in this case it makes sense for white space to be not permitted in passwords. Since I'm not convinced that there is an entropy advantage in allowing spaces, I don't see why banning whitespace is a problem.
- ericd 16y ago
  It's much better just to email them a password reset link. It's a little more complicated, but passwords should never be emailed plaintext, because a huge percentage of people use the same one across multiple sites. I live like a tech luddite except when developing, so I don't use a password store for low security sites. One of my low security/throwaway passwords includes a space.

by kunley 16y ago

rlpb 16y ago

What about in the case of a password reset request? Ultimately there has to be some mechanism for a password reset, and there must be some level authentication during this reset. How about a non-security-sensitive website which has a registration function and the only form of contact is via the registered email address? Users are likely to forget their passwords. The only way to verify a user in order to reset his password is with his email address. If you reset the password on request and then email it, then there is effectively a DoS there, and you are requiring the user to take extra effort (going back in and changing it again). If you email the existing plaintext password to him on request, then there is no DoS issue and minimal hassle for the user - provided that the security requirements make it acceptable for 1) a plaintext password to be emailed (but otherwise what else are you going to do?) and 2) the old password to be continued to be used even after it has been emailed in plaintext. I'm not sure which of the two options I would implement myself. I'm not even aware of what existing webapps do since I use a password safe and so have never had to go through the process. I'm just saying that for a non-security-sensitive situation, I have no major objection to the second option being used, and in this case it makes sense for white space to be not permitted in passwords. Since I'm not convinced that there is an entropy advantage in allowing spaces, I don't see why banning whitespace is a problem.

ericd 16y ago
It's much better just to email them a password reset link. It's a little more complicated, but passwords should never be emailed plaintext, because a huge percentage of people use the same one across multiple sites. I live like a tech luddite except when developing, so I don't use a password store for low security sites. One of my low security/throwaway passwords includes a space.