Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

We've recently moved to a better password storage strategy, with it came all the good stuff:

  • Passwords are stored after going through bCrypt
  • User is sent an activation link on account creation to confirm ownership of address
  • Forgot password without security question, a link is sent to their email.
  • The link expires after 24 hours, at which point they will need to request a new one.
  • If the account is created from our staff, an email is sent with a random strong password in it. Upon login in the user has to reset it to something we don't know and that is bCrypt'd.

Now this is in accordance with the "best-practice" around, but this increased our amount of support request a lot from regular users who don't understand all this, they just want to login.

We often get request from users who complain about:

  • Incorrect password (from the one that they need to reset they often paste it with a space at the end). They tell us what they are using but we have no way of telling them what their actual password is.
  • Saying they aren't receiving the email we send them (activation, reset, etc.). This is often not the case, after much troubleshooting we usually found out they did a typo in the email, that they aren't checking the right email account or that it simply went in the spam folder.

We of course can not try it for them as we don't have the password. We are logging the failed attempts but we also clear the password they used since it's likely to be the password used for another account and we didn't want to store in a plain text log file. This leaves us with pretty much nothing to help them when they report problems.

I’m curious as to how most people deal with issues like these?

share|improve this question
2  
Other than being a little more descriptive in the e-mails your system sends to users, I don't see what you could do differently while maintaining best practices. Makes you wish you could just slap the stupid users. –  Bernard Feb 24 '12 at 20:07
    
People are stupid, your users, more so than most others, I don't see the question here? –  Jarrod Roberson Feb 24 '12 at 20:24
7  
Jarrod you're just insulting your users. The one stupid here is you. You fail to understand level of computer literacy of your users. No offense man, but you're writing software for people not for computer geeks. If you see no question probably it means that all those usability experts out there sould be fired, because they're not needed really. It's just problem with "stupid people", so we - clever developers just ban them from web and the problem will be gone :) If someone wrote a system that only the author can use you don't see a problem? –  Slawek Feb 24 '12 at 20:34
1  
@Slawek: no, really, people are stupid. –  insta Feb 24 '12 at 20:48
    
@JarrodRoberson, its hardly just his users - when dealing with public facing web applications, thats generally what you get. That said, like it or not, it still takes up support resources, and is very valid question. –  GrandmasterB Feb 24 '12 at 21:40
add comment

7 Answers

I'd say use a third party authentication method, like Facebook, OpenID, Google... whatever is appropriate for your users. However, if your users can't remember your password, maybe they won't be able to use a third party authentication system...

Depending on your situation, you might be able to use another system, such as SSL client certificates (they are definitely hard to install for end users, but if this is a company and you can automate its installation, it's great), Windows SSO, a mobile app, etc.

share|improve this answer
    
Client certificates are an awfull idea. They are Insecure and a nightmare to fix remotely if something goes wrong. Openid is a good idea though –  Tom Squires Feb 24 '12 at 20:49
    
How are certificates insecure? –  Bernard Feb 24 '12 at 20:52
    
@bernard anyone who is at that PC has the certificate. Its also fairly easy to get.one out with a virus –  Tom Squires Feb 25 '12 at 13:56
1  
I agree that they are only as secure as the machine they reside on, but that's a different issue altogether. –  Bernard Feb 25 '12 at 13:59
add comment

The first thing that jumps out is that your emails are going into junk mail. Setting up email so it is recognized as real isn't trivial. I suggest you look into how to stop your email being flagged incorrectly (separate question on SO?)

The second thing I would recommend is giving your users a one click website/app that initiates the password recover emails. Refuse to do it any other way than email, it's unsecure and sets a bad precedent.

share|improve this answer
    
Not that e-mail is a particularly secure way of transmitting sensitive information. If only regular users could be bothered with GPG and ssh keys... –  tdammers Feb 25 '12 at 7:42
    
@tdammers i agree it isn't so secure. It has however become the keystone of your online identity (for better or worse). There isn't currently a better viable alternative. –  Tom Squires Feb 25 '12 at 22:38
    
Yes there is. Encrypted e-mail. I use it all the time, and it annoys me that even huge corporations don't bother offering pubkey encryption for sensitive e-mail. It's not even hard to implement. I find it odd that laws exist (at least here in the Netherlands) that make SSL mandatory for sensitive information, but at the same time, sending the same information over plain SMTP is deemed acceptable. –  tdammers Feb 26 '12 at 8:43
    
@tdammers I don't know enough about it to recommend it myself. Its defiantly worth OP looking into though –  Tom Squires Mar 2 '12 at 9:34
add comment

Incorrect password (from the one that they need to reset they often paste it with a space at the end). They tell us what they are using but we have no way of telling them what their actual password is.

Fixable by instead including a link with a one-time GUID that logs them in and forces them to reset the password. Don't force the user to copy-paste. (Also, why not strip whitespace at end of password in your form.)

Saying they aren't receiving the email we send them (activation, reset, etc.). This is often not the case, after much troubleshooting we usually found out they did a typo in the email, that they aren't checking the right email account or that it simply went in the spam folder.

Make sure your outgoing e-mail is de-spammed (maybe setup test accounts on some common mail services), log anything that happens and maybe report that to the user if they try to request a new reset (i.e., mail to johndoee@gmail.com failed, user not found, did you spell it correctly?). Also, be clear to users about spelling and spam issues.

Also, OpenID and other third-party auths are also an option, as others have said.

share|improve this answer
add comment

Do you even need to be doing it? The first thing you need to do it determine what you are protecting and who you are protecting it from. Maybe it's just no worth the cost of best practice, and maybe best practice won't even stop your attacker.

If you are up against the NSA, and have something they want, give up and make your users life easy. If you have credit card numbers, then you will have to put up with the problems the required level of security requires, because theres bad guys out there who want them and will spend money and time to get them. It it's access to a family photo album, do you need all that security.

Read up on Buce Scheiners works (Secrets and Lies) as a good start to understanding security.

share|improve this answer
add comment

The fact that they are willing to call you up and tell you their password out loud tells you that to these users, the password and the info it protects is not that big a deal. I would never do any of those things with my banking password. But there are a number of sites that demand passwords for things that really don't deserve them. I have one standard password I use for all of those, and the more "hey that's not a strong password" or "we'll make you a password and force you to change it regularly" and so on, the less I want to use that service. I would have a short conversation with the "business value" people in your life to see whether in fact just keeping them plain-text in the db and emailing them to people on request would be a better approach.

If in fact this should be this secure, you could try what one of my clients did with the system we coded for them. While on the phone with the person, go into the db and change their email address to yours. Then go on the web and click Forgot Password. Wait for the email and use it to log in. Using the website, change the password to Password or something else that you verbally agree with the customer. Change their email address back to their own address and tell them "all set, your new password is active now!" Happy customer and you don't have to explain to them what all is going on.

share|improve this answer
2  
Direct database modification is a security breach in itself. This means that you can impersonate any user using your system. –  Bernard Feb 24 '12 at 20:14
2  
My clients had a Windows app with which they could edit any field for any user, say if they got a fax saying that they now had a new phone number. Of course it was audited. Of course when I saw this written procedure taped to the wall near the support desk I was NOT HAPPY. But I came to accept it, and there is an audit trail showing what happened should anyone ever call and complain their password was reset without their consent. The thing is, not everything needs to be this secure. And the users are telling you this doesn't need to be. –  Kate Gregory Feb 24 '12 at 20:26
1  
Unfortunately, most users don't know any better. It's up to the developers of software applications to enforce best practices. –  Bernard Feb 24 '12 at 20:36
3  
I agree that this is a big security hole. And I agree that it may be the most appropriate solution. It does however seem incredibly silly for customer support to have to temporarily change the customer's email address to reset that user's password: if you're going to let customer support reset passwords, just let them do it directly. –  John Bartholomew Feb 24 '12 at 20:47
4  
I would also note that revealing plain-text passwords that users have set (in fact, storing passwords in plain-text at all) is, in my opinion, hugely worse than giving customer support the ability to directly change user passwords. –  John Bartholomew Feb 24 '12 at 20:53
show 1 more comment

the method of last resort I used on a system with very illiterate users in the past was to direct the user to a screen where they were given a phone # and a confirmation number. They called the phone number, verified their identity through manual means then read the confirmation. the support person logged into a separate system, entered the number and got a second number to give back to the client. the client used the second code to continue to the reset password page. the client version of the page could not run from the support personnel's sub-nets and the support screen could not run from the clients.

it isn't bulletproof as a support person could use a vpn to run both ends from one location, but it was sufficient for audit since the support account was logged as responsible for the activity

share|improve this answer
add comment

Maybe by implementing security rules that are not INSANE. By doing this, all you're getting is less security really, because the system is so hard to use that your clients will reeval passwords to you and their friends just to get it working!

Can't you just send them NORMAL links, then password below. If the link gets broken by email client just display the form with one field "activation code"... "type activation code you have in the email"... 5 digits so they won't mistake 0 with O, etc. 4 digits are ok for credit cards and you need so complicated policy for simple login? If the code won't work repeat the check with TRIMmed string? I guess it won't make it less secure, right? :)

For me it happens often too... i doubleclick on password and ending space gets copied. It's unbelivable to me why peple can't figure out just to remove ending white chars when the check failed and repeat the process? Then maybe TOGGLE letter casing for me to check if i didn't press CL accidentally.

You have overcomplicated it so badly. It's not "reset password" and "initial password"... but "Confirmation code" and "Enter confirmation number we send you to the email", "Don't have email? It was send to xxx@yyy.com, check your spam again, still dont have it? Resent your confirmation email". In HTML body a link. http://xxx.com/conf-12345-mymail-gmail-com.html. No mail client will break this.

share|improve this answer
5  
The security policy he mentioned is not only not "INSANE" but should be a requirement of all "SANE" applications. Links like this sent via e-mail have to expire after awhile to prevent the password from being reset (either by thievery of the link directly, or by stumbling upon it via computer aided algorithm). Passwords probably should be trimmed before validated though. Users ARE stupid. It is Law. The answer isn't to reduce our security measures but to take proactive steps to help ensure our users understand the proper procedures. –  Dalin Seivewright Feb 24 '12 at 21:03
4  
-1. This is a sane way of doing it, that most sites use. If I issue a "forgot password" on a site, and get an email with my password in plain text, I close my account. –  Matt Grande Feb 24 '12 at 21:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.