Re^3: It's been ten years ...

[haj]

Lanx writes:

This would imply adjusting the What's my password? mechanism too.

Yes, of course. You can improve easily by creating a fresh random password and mailing that to the user, and then store it encrypted. After all, they forgot their password, right?

This is still bad security practice, though, as plain text email isn't actually secure. With a bit more effort you can get a decent self-service password reset function. This has been done before, it isn't rocket surgery.

[tinita]

Yes, of course. You can improve easily by creating a fresh random password and mailing that to the user, and then store it encrypted.

No, please no!

(I know many websites do this.)
So everone claiming "I am user X and I forgot my password" can now reset my password, and I am locked out and have to check my email.

The minimum password procedure should be: store an intermediate token, send the user a link with that token and then let them enter their new password. And that means, we need a new endpoint *and* a new database table probably. So it's not that trivial.

[LanX]

I didn't use a token but a one way URL which is timing out after an hour.

Needed two extra tables IIRC...

To be able to integrate this here one would need godly powers or an offline development environment.

[LanX]

> With a bit more effort you can get a decent self-service password reset function. This has been done before, it isn't rocket surgery.

I know, "a decent self-service password reset function" was my first task at my current job.

Good luck integrating it here!