1–10 of 33 posts
What do you guys recommend?
2) Don't just hash. Use bcrypt, since it's probably got a library for you to use in your language (or database) of choice: http://codahale.com/how-to-safely-store-a-password/
1) I like the single-use token, but I'm interested in hearing others' perspectives. 2) Don't just hash. Use bcrypt, since it's probably got a library for you to use in your language (or database) of choice: http://codahale.com/how-to-safely-store-a-password/
I'm not going to use/keep the generated password you send me, so just linking me to a page that lets me pick a new password to begin with works best for me.
As a site user, I'd want to just have a link I can click to pick a new password. I'm not going to use/keep the generated password you send me, so just linking me to a page that lets me pick a new password to begin with works best for me.
1) I like the single-use token, but I'm interested in hearing others' perspectives. 2) Don't just hash. Use bcrypt, since it's probably got a library for you to use in your language (or database) of choice: http://codahale.com/how-to-safely-store-a-password/
We do use BCrypt. Trying to figure out if implementing an extra layer of sending an email with a link to reset password has advantages over just sending a one time changed password.
As a result, any future brief read-only compromise of their mailbox revealing that password may grant unauthorized access to their account.
Sending a time-limited link forces the choice of a new password. They might choose unwisely, but it would take an active compromise of their mailbox (intercepting a future reset-request) to leverage a password-reset to future compromise. If they do choose a bad password, that could be as bad as having your password sitting in their mailbox.