3 ms·
If someone hacks into your email account, they can just trawl through the email archive and harvest passwords from past password reminder emails. With a tempora
by pmjordan 12y ago
If someone hacks into your email account, they can just trawl through the email archive and harvest passwords from past password reminder emails. With a temporary reset token, they have to initiate a password reset request, which you should notice: (a) you might notice the email if you have e.g. push notifications enabled, or if the attacker doesn't delete it quickly enough, and (b) your real password will suddenly stop working.
Additionally, even if your reset request is harvested via MITM, if you use a single-use reset token, and an attacker uses it before you can, you know something is up. Even if it's not single-use, your password suddenly no longer working should ring alarm bells.
- hackuser 12y agoAnd if someone hacks the system administrator's account, they may find everyone's passwords (for systems where the admin sets the pw and emails it).
- bartwe 12y agoYou're current password shouldn't stop working because otherwise that can be used as a denial of service without otherwise compromising the security of either the user or the site if the email address is known.
- pmjordan 12y agoObviously it shouldn't stop working straight away, but presumably an attacker would actually use the password reset code, at which point they would set your password to something else, which you would notice.