CODEWITHSUNDEEP
securitypasswordspassword-recovery
Belmin Fernandez
Belmin Fernandez

Reputation: 8647

Are reset password links a bad idea?

We have a password reset web application. The application sends out an confirmation code to an alternative e-mail. My manager believes it is not a good idea to include a link to the page were you have to enter the code.

I see his argument. However, the helpdesk has been overwhelmed with users who are confused about the process. I'm assuming this is because many our users browse using only one tab/window and navigate out of our web application to check their e-mail for the confirmation code.

My question: How should we approach this issue? I would like to alleviate helpdesk and, in turn, make the process pain free for our users. Any suggestions?

Clarification

He believes that we are doing the user a disservice by training them to click links from a sender that cannot be verified (in this case, it's an automatic message with a "no-reply" address). This, would in turn, make users more susceptible to phishing attempts which we've had a lot of issues with in our organization.

Upvotes: 0

Views: 863

Answers (3)

Valentin Flachsel
Valentin Flachsel

Reputation: 10825

I see no reason why the link shouldn't be included, especially if the code is something like a hash because the chances of somebody cracking that are slim to none.

You could however, add an extra protection to the page where the code is being inserted and limit the number of tries to something like 3. For even more protection, send the email address to that page as well, and allow 3 tries per email address instead of 3 tries / IP, which can be easily bypassed.

Upvotes: 0

Eiko
Eiko

Reputation: 25632

I think sending links is the standard way of doing it. If a customer is really worried about the integrity of this email account, he better gets that sorted out first.

Essentially you don't gain extra security by not sending the link, but you gain a lot of comfort. Just do it like everyone else - put it in there (time limited).

Upvotes: 1

Linus Kleen
Linus Kleen

Reputation: 34632

The only thing on the top of mind would be the option to have a unique identifier in the e-mail's subject an have the customers reply to that mail.

Then an automated script checks '[email protected]' for emails with the subject 'Re: Forgot your password? [UNIQUEID]'. The script would then mail them their new password.

Since most users won't modify the subject when hitting "Reply To" and won't do a "Compose new mail" and enter the recipient address manually, chances are big, incoming mails to "password-forgotten" will have that UNIQUEID in the subject.

Plus helpdesk would only have help those that actually modify the email's "Subject". ;-)

There are security considerations, though. Maybe your manager might argue, that anyone might send a forged "Forgor your password" mail and set the "Reply-To" header to the attacker's address. The processing script has to intercept these attempts of forgery...

Upvotes: 1

Related Questions