3 ms·
Yet when I get a reset password email the exact same things happen... so for sites where that reset password is good enough it is also good enough to send auto
by calloc 15y ago
Yet when I get a reset password email the exact same things happen... so for sites where that reset password is good enough it is also good enough to send auto login links.
- IgorPartola 15y agoYup. And sending reset passwords link is just as insecure. Just because it is the accepted practice does not mean it's a good idea. Introducing some sort of security questions helps a bit, depending on implementation. Another idea would be to ask the user to create a temporary PIN, that is then used to sign the token, and is asked for again, when the user actually clicks the emailed link. Lastly, users are more or less trained not to forward password reset emails. However, getting an email that says "Your stock is burning, click here to sell all." might cause the panic-stricken user to forward this email to his/her broker.
- itcmcgrath 15y agoExcept people are not use to simply forwarding an email giving anybody access to their account.