I recently had a discussion with someone about what a good self-service password reset system means for online applications. It sounds so trivial, but it has raised a number of important security concerns related to the way we write our applications. I’m going to introduce some common password reset approaches, what types of scenarios work best, and when to use them in relation to each other. In this content provided by Gadgets Wright, I will show you the 5 options from the numerous password reset options for online apps.
Why Should you Change or Reset your Password for your Online Apps with the Options here
The online apps you use contain a lot of important and sensitive data, so the security of the online apps’ data has top priority. A security tip for online app users is to keep changing OR even reset your passwords for something new often. However, it is not always clear why you should do something so uncomfortable in a consistent manner. Changing your password avoids a number of dangers, some of which are less obvious. But for your safety and the safety of your information, it is important that you reset your online apps with any of the options displayed in this content.
Option 1: Email the original password
Many applications send the original password via email. It is absolutely terrible. This means that the programmer has the password either in plain text or in bidirectional coding, which can be easily converted into plain text. For a moment, forget about the security implications when you send an unencrypted email password. What happens if an attacker confiscates this database or causes it to spit out this data? Anyone who uses this password on other popular websites is at risk. Not only should you not do this, but your system shouldn’t be able to.
Option 2: Email a new, random password
This isn’t the worst option in the world, especially for a site that doesn’t contain a lot of confidential information. You can send a new randomly generated password and suggest (or force the user) to change it when they reconnect. Security is provided by your email system. It’s a potential vulnerability in itself, but for a low-value system without the type of hackers you would be interested in, it could work just fine.
Option 3: Email a very short time password reset link
Another route that email uses as an identity verification system is to send a link that contains a long string of random characters that result in a clear, time-limited password reset screen. It is safer than option 2 because the link can only be used once and with a limited window that can be used if the link falls into the wrong hands. However, he still has the weakness of using the user’s messaging system as a determinant of identity.
Option 4: Secret questions
More and more websites seem to be moving in the direction of the secret question system, in which the user is asked questions when connecting, which only he can answer, e.g. His mother’s pet or maiden name under. In my opinion, it is an incredibly precarious system.
First of all, anyone who knows me well (or who is a friend of mine on Facebook) already knows or can find my mother’s maiden name, which high school I attended, my birthday, the first car I ever bought, my favorite animal and more. To make matters worse, secret questions are often stored in plain text. When a hacker visits a site’s database, he can answer secret questions on many sites. And unlike passwords, it’s very unlikely that you’ll use different answers to the same questions on different websites.
Secret questions are only really safe if they are based on location-specific information that may not have been provided electronically (e.g., an account number that is only displayed) on the company’s paper correspondence).
Option 5: Reset via phone
Some websites are now sending an SMS verification code to perform the password reset. I really like this strategy. “Hacking” my SMS address involves restoring my phone (or planting a virus on it, and some phone operating systems like Windows Phone 7 don’t allow apps to read SMS anyway) at a completely different level than the security room.
The big disadvantage is for users without access to SMS messages. Depending on your target group (e.g. military personnel in highly secure locations, people in remote areas, etc.), this may be the case. It is also assumed that you have a way to send SMS. This isn’t the easiest task in the world and usually involves signing up for a third-party paid service.
Which option to choose?
In my opinion, options 3 and 5 offer the greatest security. Option # 3 does not email passwords, and if the email system is hacked, compromised, or exposed, the attacker has little time to do anything with it. For example, if your emails are found as legal evidence, no one can respond to the clear, time-limited link. Option 5 has the advantage that the authentication device must be physically owned. Also, avoid total emails. Of the other three, option n is probably the worst, because you are forced to keep sensitive data that is not relevant to the application, dangerous data in the hands of an attacker, and authentication is based on easily accessible information.