#1684 - Security Questions for password resets

By Chris Graham
Added 29th Aug 2014, 4:54 PM
3 views

Identifier	#1684
Issue type	Feature request or suggestion
Title	Security Questions for password resets
Status	Closed (rejected)
Tags	Type: Security (custom)
Handling member	Chris Graham
Addon	core_cns
Description	Support security question(s) in the lost_password module - you need to enter your security answers correctly before it will initiate a reset. Provide static list of questions user can answer, allow user to create their own.
Steps to reproduce
Funded?	No

The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".

Rating

Unrated

Comments

By Guest posted 6th Feb 2021, 6:45 PM

I think it is better we just have 2FA to include the lost password form. If someone has enabled 2FA they have to successfully go through 2FA (be it SMS code, Google Authenticator,, or a recovery code), to do a password reset. If they can't do that, they can talk to an admin about regaining access.

No need to have multiple tangential approaches to security. Best to center around one set of very well implemented concepts.

By Guest posted 6th Feb 2021, 6:46 PM

Just to be clear, this would be a 2FA reset. So they'd have the SMS/Google Authenticator/Recovery code factor COMBINED with the email factor. Instead of the current single factor reset, which is just email.