This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Talk:Forgot Password Cheat Sheet

From OWASP
Revision as of 02:43, 15 September 2017 by Jmanico (talk | contribs) (Glenn is not reading :))

Jump to: navigation, search

Secret Questions

Should we really be suggesting secret questions/answers in 2017? It's sort of a terrible mechanism, that largely provides little additional security benefit. There are much better options, notably 2FA.

- Glenn 'devalias' Grant (Sept 14, 2017)

Glenn, please see section 3. We explicitly discuss MFA as a critical step. Many companies who do a MFA workflow consider the secret questions step to be optional.

- Jim Manico (Sept 14, 2017)

Retrieved from "https://wiki.owasp.org/index.php?title=Talk:Forgot_Password_Cheat_Sheet&oldid=233312"