News for hackers. Stuff that matters.

A comment on Is Your Site Leaking Password Reset Links?.

Re:Is Your Site Leaking Password Reset Links? by jpalomaki on Monday October 24, 2016 @08:30AM (#12778201)
One option is to avoid putting the token to the link and at least provide user a simple way of copy-pasting the token to the password reset form.

Sometimes this is actually something I as user want to have, since it might be that I'm receiving the email on device A, but want to reset the password on device B.

And please keep the password reset tokens sane. If you are not encoding some data into the token, you don't really need that 80 character random string for security.

[ Parent | on HN ]
Re:Is Your Site Leaking Password Reset Links? by derekprior on Monday October 24, 2016 @08:50AM (#12778279)
I'd certainly consider this for some applications. It depends on the value of what you are protecting. For some sites and users, the error rate introduced by this method would be unacceptable.

Tradeoffs...

[ Parent | on HN ]
Re:Is Your Site Leaking Password Reset Links? by tinus_hn on Monday October 24, 2016 @09:35AM (#12778606)
Many people do not understand copy and paste at all.
[ Parent | on HN ]