We've recently moved to a better password storage strategy, with it came all the good stuff:
- Passwords are stored after going through bCrypt
- User is sent an activation link on account creation to confirm ownership of address
- Forgot password without security question, a link is sent to their email.
- The link expires after 24 hours, at which point they will need to request a new one.
- If the account is created from our staff, an email is sent with a random strong password in it. Upon login in the user has to reset it to something we don't know and that is bCrypt'd.
Now this is in accordance with the "best-practice" around, but this increased our amount of support request a lot from regular users who don't understand all this, they just want to login.
We often get request from users who complain about:
- Incorrect password (from the one that they need to reset they often paste it with a space at the end). They tell us what they are using but we have no way of telling them what their actual password is.
- Saying they aren't receiving the email we send them (activation, reset, etc.). This is often not the case, after much troubleshooting we usually found out they did a typo in the email, that they aren't checking the right email account or that it simply went in the spam folder.
We of course can not try it for them as we don't have the password. We are logging the failed attempts but we also clear the password they used since it's likely to be the password used for another account and we didn't want to store in a plain text log file. This leaves us with pretty much nothing to help them when they report problems.
I’m curious as to how most people deal with issues like these?