Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I read this answer http://programmers.stackexchange.com/questions/15350/why-do-websites-restrict-the-number-choice-of-characters-in-a-password/15351#15351 and found a comment insisting not to send password in E-Mail, this raises me the question of handling Forgot Password option? At any cost the raw password must be displayed in any UI so that user will be able to read it. So what would be the BEST/BETTER way to handle "Forgot Password"

share|improve this question
    
I just spent 15 minutes explaining the PHPBB forgot password feature. –  Peter Turner Oct 28 '10 at 20:00
add comment

5 Answers

up vote 26 down vote accepted

A good application design will not be able to explicitly recover a users password. This is because it is usually stored after it is run through some sort of hash which is a one way operation.

The best way to handle lost password is to perform a reset, email to the users account a link with a generated parameter tacked on that identifies this as a valid password reset for the account in question. At this point they can set a new password.

This does assume you have a users email address on file.

share|improve this answer
    
There are additional "best practices" that, while not critical (like not storing the passwords in the first place), should be in place if time allows, including having the temporary access token expire on certain events and over time (so that someone's account is not compromised if his inbox is). –  Steven Xu Jan 27 '11 at 22:59
add comment

My credit card provider has a "forgotten password" option that asks you some security questions ( this is not immensely secure in itself but lots of banks do it ) and then generates a new code and gives you half on screen and emails the second half to you. That way you can't break the account without access to both the web page and the email address.

I have asked a little about this from a usability perspective a while back.

share|improve this answer
add comment

The comment is against sending the original password in email, not sending anything in email. If the institution can send the original password, that means they have it, and that's a security problem. The commenter was not arguing against sending a password through email, because that's pretty much necessary in most cases.

The proper way is to assign a new password that's usable once, for whatever reason. Perhaps it's already marked expired by the system, perhaps it just logs into a page to change the password that's dynamically generated once and only once, whatever.

share|improve this answer
add comment

The thing I like the best is for the application to send an email to the user on the registered email-address with a one-time link valid for X hours which provides a "Change password" page.

The user can then set the password as s/he likes without risking having it put in an email.

share|improve this answer
add comment

You should not store the users main password as plaintext, but you CAN store a temporary password as plaintext, i.e

user resets password -> temp password is created -> temp password is sent via email -> user is forced to change password at next log in (new password can't be temp password maybe)

share|improve this answer
2  
I've done this in several sites. While you can argue that a mail snooper can get the password, they can also get whatever other temporary token etc you would email. This approach is simpler for the user (they can copy and paste or even type the temp password) and doesn't take a security hit. –  Kate Gregory Oct 28 '10 at 15:52
    
Unless somebody is using secure way to connect to mail server (i.e. web mail via HTTPS or POP3 over TLS), such communication could be easily sniffed. In that case some "haX0r" could easily log into other user's account. That's why it is bad idea. Reset link should be sent as Chris suggests and accompanied security question should be asked before actually letting user to change his/her password. Still not 100% safe (as many times answers to such security questions could be easily guessed), but I can't see any better solution. –  Paweł Dyda Oct 28 '10 at 15:55
1  
@Pawel Dyda A reset link can also be sniffed, if your email is getting sniffed i think having a temp password in your email is the least of your worries. –  Viper_Sb Oct 28 '10 at 15:57
    
That's why I wrote about security question. –  Paweł Dyda Oct 28 '10 at 17:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.