Ask HN: Strategy for password reset email vs URL to reset pwd

Re:Ask HN: Strategy for password reset email vs URL to reset... by halayli on Sunday July 17, 2011 @11:32PM (#2775007)

So if I know a user's email I can lock their account by just triggering a reset password.

[ Parent | on HN ]

Re:Ask HN: Strategy for password reset email vs URL to reset... by ra on Monday July 18, 2011 @01:10AM (#2775193)

Yeah brute force lockout is a destructive attack.

A better lock-out approach is to disable logins for a period of time (say 1 minute)... i.e. as someone said above, you don't want to destroy the old password in case the reset was requested by someone else.

[ Parent | on HN ]