What is the best “forgot my password” method? [duplicate]

by

4) Crediting their bank account with two random amounts and ask them to enter those in.
5) Snail mail them some new password and ask them to enter it in.
6) Have them text or call some number and enter some value to a phone number with the mobile phone they registered on file.
7) Get out of the password management problem altogether by outsourcing it to OpenID providers like Stack Overflow, Facebook, blog engines, and others are starting to do.

Outside of those, use option #1 or #2 with the added feature that both expire in an hour.

More Related Contents:

  1. Best way for a ‘forgot password’ implementation? [closed]
  2. md5 decoding. How they do it?
  3. Why not use MD5 for password hashing?
  4. MD5 security is fine? [closed]
  5. What is the clash rate for md5? [closed]
  6. Fundamental difference between Hashing and Encryption algorithms
  7. What is the best way to implement “remember me” for a website? [closed]
  8. JWT (JSON Web Token) automatic prolongation of expiration
  9. Are querystring parameters secure in HTTPS (HTTP + SSL)? [duplicate]
  10. Best way to handle security and avoid XSS with user entered URLs
  11. With HTTPS, are the URL and the request headers protected as the request body is?
  12. How do you protect your software from illegal distribution? [closed]
  13. What is cross site scripting?
  14. How can I throttle user login attempts in PHP
  15. Why is using a Non-Random IV with CBC Mode a vulnerability?
  16. What should every programmer know about security? [closed]
  17. Is it safe to put a jwt into the url as a query parameter of a GET request?
  18. Stopping users voting multiple times on a website
  19. How do I store and retrieve credentials from the Windows Vault credential manager?
  20. MVC 6 Bind Attribute disappears?
  21. How will a server become vulnerable with chmod 777?
  22. Why do salts make dictionary attacks ‘impossible’?
  23. IIS7, web.config to allow only static file handler in directory /uploads of website
  24. When the bots attack! [closed]
  25. How to do stateless (session-less) & cookie-less authentication?
  26. WS on HTTP vs WSS on HTTPS
  27. Is there a way to force apache to return 404 instead of 403?
  28. RSA signature size?
  29. How to send password securely via HTTP using Javascript in absence of HTTPS?
  30. Has Hardware Lock Elision gone forever due to Spectre Mitigation?

Leave a Comment