Talk:Forgot Password Cheat Sheet - Revision history

Dirk Wetter at 09:19, 3 September 2018

2018-09-03T09:19:34Z

Dirk Wetter: Security question / MFA

2018-08-31T16:02:02Z

Security question / MFA

Devalias at 05:43, 15 September 2017

2017-09-15T05:43:50Z

Devalias at 05:43, 15 September 2017

2017-09-15T05:43:36Z

Jmanico: Glenn is not reading :)

2017-09-15T02:43:40Z

Glenn is not reading :)

Devalias at 05:18, 14 September 2017

2017-09-14T05:18:42Z

Jmanico at 21:21, 2 September 2015

2015-09-02T21:21:07Z

Justin C. Klein Keane: /* Logging */ new section

2015-09-02T19:02:39Z

‎Logging: new section

Daniel Black: reference papers on challenge questions

2011-10-16T04:35:29Z

reference papers on challenge questions

New page

Needs revision based on [http://cups.cs.cmu.edu/soups/2009/proceedings/a8-just.pdf Personal Choice and Challenge Questions: A Security and
Usability Assessment]

[http://cups.cs.cmu.edu/soups/2009/proceedings/a9-schechter.pdf 1+1=You]

@@ Line 6: / Line 6: @@
 I don't want to appear rude here but I thought security questions suck big time, I second Glenn here. Weren't there celebrities accounts hacked of because of well known security questions? But I need to disagree wrt to MFA/2FA: It might be the best, it is often just not an option. IMO this cheat sheet should reflect this part of a non-ideal world, too.
-Please keep also in mind that e.g. SMS is not really a 2nd factor when simultaneously it's being send to the same smartphone receiving a factor.
+Please keep also in mind that e.g. SMS is not really a 2nd factor when simultaneously it's being send to the same smartphone receiving a mail.
 - Dirk 'drwetter' Wetter (Aug 2018)

← Older revision		Revision as of 16:02, 31 August 2018
Line 1:		Line 1:
		+
		+
		+
	== Secret Questions ==		== Secret Questions ==
		+
		+	I don't want to appear rude here but I thought security questions suck big time, I second Glenn here. Weren't there celebrities accounts hacked of because of well known security questions? But I need to disagree wrt to MFA/2FA: It might be the best, it is often just not an option. IMO this cheat sheet should reflect this part of a non-ideal world, too.
		+
		+	Please keep also in mind that e.g. SMS is not really a 2nd factor when simultaneously it's being send to the same smartphone receiving a factor.
		+
		+	- Dirk 'drwetter' Wetter (Aug 2018)

	Should we really be suggesting secret questions/answers in 2017? It's sort of a terrible mechanism, that largely provides little additional security benefit. There are much better options, notably 2FA.		Should we really be suggesting secret questions/answers in 2017? It's sort of a terrible mechanism, that largely provides little additional security benefit. There are much better options, notably 2FA.

← Older revision		Revision as of 05:43, 15 September 2017
Line 10:		Line 10:

	I know it is mentioned there, but it is mentioned as a 'do this after they fail to answer the questions', only if they fail. There is nothing in that that suggests the secret questions are/could/should be optional. I was going to refer to this as a resource for how to securely implement forgot password functionality, but I don't feel it accurately represents best practice in 2017.		I know it is mentioned there, but it is mentioned as a 'do this after they fail to answer the questions', only if they fail. There is nothing in that that suggests the secret questions are/could/should be optional. I was going to refer to this as a resource for how to securely implement forgot password functionality, but I don't feel it accurately represents best practice in 2017.
		+
		+	- Glenn 'devalias' Grant (Sept 15, 2017)

← Older revision		Revision as of 05:43, 15 September 2017
Line 8:		Line 8:

	- Jim Manico (Sept 14, 2017)		- Jim Manico (Sept 14, 2017)
		+
		+	I know it is mentioned there, but it is mentioned as a 'do this after they fail to answer the questions', only if they fail. There is nothing in that that suggests the secret questions are/could/should be optional. I was going to refer to this as a resource for how to securely implement forgot password functionality, but I don't feel it accurately represents best practice in 2017.

@@ Line 5: / Line 5: @@
 - Glenn 'devalias' Grant (Sept 14, 2017)
-== Logging ==
+Glenn, please see section 3. We explicitly discuss MFA as a critical step. Many companies who do a MFA workflow consider the secret questions step to be optional.
-I'm surprised to see that logging isn't a consideration in password reset functionality.  Knowing that users attempted a password reset, whether the reset was successful or failed, recording details of reset sessions including IP address and other details would all seem like great suggestions.
+- Jim Manico (Sept 14, 2017)

← Older revision		Revision as of 05:18, 14 September 2017
Line 1:		Line 1:
		+	== Secret Questions ==
		+
		+	Should we really be suggesting secret questions/answers in 2017? It's sort of a terrible mechanism, that largely provides little additional security benefit. There are much better options, notably 2FA.
		+
		+	- Glenn 'devalias' Grant (Sept 14, 2017)
		+
	== Logging ==		== Logging ==

@@ Line 1: / Line 1: @@
-Needs revision based on [http://cups.cs.cmu.edu/soups/2009/proceedings/a8-just.pdf Personal Choice and Challenge Questions: A Security and
+== Logging ==
-[http://cups.cs.cmu.edu/soups/2009/proceedings/a9-schechter.pdf 1+1=You]
+I'm surprised to see that logging isn't a consideration in password reset functionality.  Knowing that users attempted a password reset, whether the reset was successful or failed, recording details of reset sessions including IP address and other details would all seem like great suggestions.
-== Logging ==
+== More on Logging ==
-I'm surprised to see that logging isn't a consideration in password reset functionality.  Knowing that users attempted a password reset, whether the reset was successful or failed, recording details of reset sessions including IP address and other details would all seem like great suggestions.
+- Jim Manico Sept 2, 2015

← Older revision		Revision as of 19:02, 2 September 2015
Line 3:		Line 3:

	[http://cups.cs.cmu.edu/soups/2009/proceedings/a9-schechter.pdf 1+1=You]		[http://cups.cs.cmu.edu/soups/2009/proceedings/a9-schechter.pdf 1+1=You]
		+
		+	== Logging ==
		+
		+	I'm surprised to see that logging isn't a consideration in password reset functionality. Knowing that users attempted a password reset, whether the reset was successful or failed, recording details of reset sessions including IP address and other details would all seem like great suggestions.