News for hackers. Stuff that matters.

A comment on But why can't I send people their passwords?. Parent comment

Re:But why can't I send people their passwords? by slight on Wednesday June 25, 2014 @08:50AM (#7943557) 

  - Request password reset.
  - Sniff email with reset link.
  - Go to reset link before user does and change password.
[ Parent | on HN ]
Re:But why can't I send people their passwords? by asuffield on Wednesday June 25, 2014 @09:18AM (#7943668)
The key difference is that capturing a plaintext password means the user and attacker both share a password without the user realising, while capturing a reset link means that one of them will win and the other will observe their password reset has failed.
[ Parent | on HN ]
Re:But why can't I send people their passwords? by Mithaldu on Wednesday June 25, 2014 @08:52AM (#7943566)
That will work, however it will also leave the user with a clue that their account may have been compromised. It is also a noticable degree harder to pull off than simply sniffing a password being sent, due to needing to know the target's data necessary to request a reset.
[ Parent | on HN ]
Re:But why can't I send people their passwords? by omervk on Wednesday June 25, 2014 @12:16PM (#7944888)
Hence our mentioning that the user must receive a mail notifying of the password change.
[ Parent | on HN ]
Re:But why can't I send people their passwords? by u124556 on Wednesday June 25, 2014 @02:55PM (#7946039)
It would be better if the website allowed the user to set the new password first and then send an email to confirm the password change.
[ Parent | on HN ]