4 ms·

I dont get why you would bother using a blob for forgot password.. Isnt something like reset.php?account=joeblow&auth=md5(accountname/secretkey/first10charsofcu

I dont get why you would bother using a blob for forgot password.. Isnt something like reset.php?account=joeblow&auth=md5(accountname/secretkey/first10charsofcurrentpasshash/yymmdd) enough? You cant replay attack the reset link once its used, it expires in 24 hours and so long as the 'secretkey' was sufficiently unique, you wouldnt be able to bruteforce or crack it. All the php script needs to do is attempt to build a 'good' md5 hash and see if they match- if they do, let you input a new password to store.

tptacek 14y ago
An attacker can do an offline brute-force attack on the "secret key" in this scheme, since attackers can be presumed to know at least one valid password in the system. Just use a random string as a primary key for a token table in a database and be done with it.
- mikeash 14y ago
  The secret key could easily be huge without much of a penalty, though.
  - tisme 14y ago
    Why go for a second rate solution when a first rate solution has the same operational costs?
    - mikeash 14y ago
      No idea. Just saying that the stated objection need not apply.