x
Home / 🔮 world building / science and engineering / Information and Communication Technology / information security / Password Reset Mechanism

Password Reset Mechanism

Tips:

  • Optional: Challenge question
  • Optional: 2FA for reset too
  • Reset only after confirmation
  • Use captcha
  • Password reset link with embedded GUID with expiry
  • Delete token after reset
  • Include reset warning in email
  • Only allow reset by email
  • Send email after reset too
  • Monitor cancellations
  • Use HTTPS

NOTE: Email is not E2EE. SMTP-TLS is E2EE between a user and a server, not between users. Signal protocol, for example is.

More (similar) info: https://www.troyhunt.com/everything-you-ever-wanted-to-know/

Left-click: follow link, Right-click: select node, Scroll: zoom
x