#2304 - Greater password reset flexibility

By Chris Graham
Added 16th Mar 2016, 12:16 PM
4 views

Identifier	#2304
Issue type	Feature request or suggestion
Title	Greater password reset flexibility
Status	Completed
Tags	Roadmap: v11 (custom) Type: Security (custom)
Handling member	Chris Graham
Addon	core_cns
Description	Different sites want different complexities. We range from a situation of a non-important site that is accessed by people on fiddly smartphones who don't even know how to use computers properly, to a very high-security enterprise extranet. Implement 3 config options, replacing current password reset options: - List, New password comes from (): randomly generated and shown in 1st e-mail [], user [after link clicked from 1st e-mail], randomly generated and shown after link clicked from 1st e-mail, randomly generated and sent in 2nd e-mail - Checkbox, Ultra reset security, The 1st e-mail actually doesn't include a link, it just includes a raw reset code/password, with an obfuscated from name. The user has to know what it is to use it. - Checkbox, New password assigned is temporary only and must be changed when logging in (only applies if "user" wasn't selected for "new password comes from") - Integer, How long reset codes last for in minutes - Checkbox, Reset codes are numeric (numeric is easier to type, especially on a smartphone - but less secure for brute force cracking) In increasing order of security ** In this case the password reset code also works as a login password. When you log in using it, the system recognises this situation, and copies it to your password, making the password reset code null again.
Steps to reproduce
Related to	#1684 - Security Questions for password resets #3024 - Lost-password form privacy (and assorted discussed ideas)
Funded?	No

The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".

Rating

Unrated

Comments

By Guest posted 22nd Mar 2016, 2:11 AM

Curious. What about implementing security questions for password reset?

By Guest posted 22nd Mar 2016, 8:58 AM

See #1684

By Guest posted 27th Mar 2020, 9:48 PM

There's a lot of overlap in here with stuff already-done with the "Password reset process" option (maybe that option was inspired by this issue and I forgot to comment), and a fair amount of over-complexity. I like what we currently do. For example, there's no real reason to give the webmaster the choice between an emailed temporary password and having the confirmation link ask them to choose a new password immediately.

I don't see a reason to have numeric confirmation codes. Already it's a link to click that includes the code, unless the user has an awful email client - which I've never seen.

"Integer, How long reset codes last for in minutes" is important, and I will implement for v11 and then mark this issue resolved.