3 ms·
Is it ok to do a password reset through email? Because once you can do that you basically have email based authentication. The password only makes this autenti
by postalrat 4y ago
Is it ok to do a password reset through email? Because once you can do that you basically have email based authentication.
The password only makes this autentication less secure and it's not needed.
- _8j50 4y agoIt is not. You can initiate password reser via email but additional recovery controls like security questions should still be required. In an ideal world you have 2fa as well, if you reset that via email as well the it isn't actually 2fa, it is email based 1fa with extra steps. If your 2fa has a separate mechanism for recovery as well,that would be ideal. If it was my webapp, I would use hashes of 3 answers to user chosen questions, hashes in the browser/client. It could be an object pairing as well, every user gets a list of 30 objects or so and they pick 3 pairs as a recovery combination.
- postalrat 4y agoHashing an answer to many questions isn't prevent someone from guessing the input until the hashes match. So why bother hashing? Recovery codes exist and are created at the time before recovery is necessary. But most people are going to lose their codes. Who is going to remember what 3 things they picked out of 30 years ago?