We've recently moved to a better password storage strategy, with it came all the good stuff:

  • Passwords are stored after going through bCrypt
  • User is sent an activation link on account creation to confirm ownership of address
  • Forgot password without security question, a link is sent to their email.
  • The link expires after 24 hours, at which point they will need to request a new one.
  • If the account is created from our staff, an email is sent with a random strong password in it. Upon login in the user has to reset it to something we don't know and that is bCrypt'd.

Now this is in accordance with the "best-practice" around, but this increased our amount of support request a lot from regular users who don't understand all this, they just want to login.

We often get request from users who complain about:

  • Incorrect password (from the one that they need to reset they often paste it with a space at the end). They tell us what they are using but we have no way of telling them what their actual password is.
  • Saying they aren't receiving the email we send them (activation, reset, etc.). This is often not the case, after much troubleshooting we usually found out they did a typo in the email, that they aren't checking the right email account or that it simply went in the spam folder.

We of course can not try it for them as we don't have the password. We are logging the failed attempts but we also clear the password they used since it's likely to be the password used for another account and we didn't want to store in a plain text log file. This leaves us with pretty much nothing to help them when they report problems.

I’m curious as to how most people deal with issues like these?

  • 2
    Other than being a little more descriptive in the e-mails your system sends to users, I don't see what you could do differently while maintaining best practices. Makes you wish you could just slap the stupid users.
    – Bernard
    Commented Feb 24, 2012 at 20:07
  • 1
    People are stupid, your users, more so than most others, I don't see the question here?
    – user7519
    Commented Feb 24, 2012 at 20:24
  • 8
    Jarrod you're just insulting your users. The one stupid here is you. You fail to understand level of computer literacy of your users. No offense man, but you're writing software for people not for computer geeks. If you see no question probably it means that all those usability experts out there sould be fired, because they're not needed really. It's just problem with "stupid people", so we - clever developers just ban them from web and the problem will be gone :) If someone wrote a system that only the author can use you don't see a problem?
    – Slawek
    Commented Feb 24, 2012 at 20:34
  • 2
    @Slawek: no, really, people are stupid. Commented Feb 24, 2012 at 20:48
  • @JarrodRoberson, its hardly just his users - when dealing with public facing web applications, thats generally what you get. That said, like it or not, it still takes up support resources, and is very valid question. Commented Feb 24, 2012 at 21:40

7 Answers 7


Incorrect password (from the one that they need to reset they often paste it with a space at the end). They tell us what they are using but we have no way of telling them what their actual password is.

Fixable by instead including a link with a one-time GUID that logs them in and forces them to reset the password. Don't force the user to copy-paste. (Also, why not strip whitespace at end of password in your form.)

Saying they aren't receiving the email we send them (activation, reset, etc.). This is often not the case, after much troubleshooting we usually found out they did a typo in the email, that they aren't checking the right email account or that it simply went in the spam folder.

Make sure your outgoing e-mail is de-spammed (maybe setup test accounts on some common mail services), log anything that happens and maybe report that to the user if they try to request a new reset (i.e., mail to [email protected] failed, user not found, did you spell it correctly?). Also, be clear to users about spelling and spam issues.

Also, OpenID and other third-party auths are also an option, as others have said.

  • some people put spaces in their passwords?
    – soandos
    Commented Apr 27, 2016 at 15:19
  • Some people cut'n paste auto-generated passwords and include spaces at beginning and/or end accidentally. (Read the question.)
    – Macke
    Commented Apr 28, 2016 at 6:13

I'd say use a third party authentication method, like Facebook, OpenID, Google... whatever is appropriate for your users. However, if your users can't remember your password, maybe they won't be able to use a third party authentication system...

Depending on your situation, you might be able to use another system, such as SSL client certificates (they are definitely hard to install for end users, but if this is a company and you can automate its installation, it's great), Windows SSO, a mobile app, etc.

  • Client certificates are an awfull idea. They are Insecure and a nightmare to fix remotely if something goes wrong. Openid is a good idea though Commented Feb 24, 2012 at 20:49
  • How are certificates insecure?
    – Bernard
    Commented Feb 24, 2012 at 20:52
  • @bernard anyone who is at that PC has the certificate. Its also fairly easy to get.one out with a virus Commented Feb 25, 2012 at 13:56
  • 1
    I agree that they are only as secure as the machine they reside on, but that's a different issue altogether.
    – Bernard
    Commented Feb 25, 2012 at 13:59

Do you even need to be doing it? The first thing you need to do it determine what you are protecting and who you are protecting it from. Maybe it's just no worth the cost of best practice, and maybe best practice won't even stop your attacker.

If you are up against the NSA, and have something they want, give up and make your users life easy. If you have credit card numbers, then you will have to put up with the problems the required level of security requires, because theres bad guys out there who want them and will spend money and time to get them. It it's access to a family photo album, do you need all that security.

Read up on Buce Scheiners works (Secrets and Lies) as a good start to understanding security.


The first thing that jumps out is that your emails are going into junk mail. Setting up email so it is recognized as real isn't trivial. I suggest you look into how to stop your email being flagged incorrectly (separate question on SO?)

The second thing I would recommend is giving your users a one click website/app that initiates the password recover emails. Refuse to do it any other way than email, it's unsecure and sets a bad precedent.

  • Not that e-mail is a particularly secure way of transmitting sensitive information. If only regular users could be bothered with GPG and ssh keys...
    – tdammers
    Commented Feb 25, 2012 at 7:42
  • @tdammers i agree it isn't so secure. It has however become the keystone of your online identity (for better or worse). There isn't currently a better viable alternative. Commented Feb 25, 2012 at 22:38
  • Yes there is. Encrypted e-mail. I use it all the time, and it annoys me that even huge corporations don't bother offering pubkey encryption for sensitive e-mail. It's not even hard to implement. I find it odd that laws exist (at least here in the Netherlands) that make SSL mandatory for sensitive information, but at the same time, sending the same information over plain SMTP is deemed acceptable.
    – tdammers
    Commented Feb 26, 2012 at 8:43
  • @tdammers I don't know enough about it to recommend it myself. Its defiantly worth OP looking into though Commented Mar 2, 2012 at 9:34

The fact that they are willing to call you up and tell you their password out loud tells you that to these users, the password and the info it protects is not that big a deal. I would never do any of those things with my banking password. But there are a number of sites that demand passwords for things that really don't deserve them. I have one standard password I use for all of those, and the more "hey that's not a strong password" or "we'll make you a password and force you to change it regularly" and so on, the less I want to use that service. I would have a short conversation with the "business value" people in your life to see whether in fact just keeping them plain-text in the db and emailing them to people on request would be a better approach.

If in fact this should be this secure, you could try what one of my clients did with the system we coded for them. While on the phone with the person, go into the db and change their email address to yours. Then go on the web and click Forgot Password. Wait for the email and use it to log in. Using the website, change the password to Password or something else that you verbally agree with the customer. Change their email address back to their own address and tell them "all set, your new password is active now!" Happy customer and you don't have to explain to them what all is going on.

  • 2
    Direct database modification is a security breach in itself. This means that you can impersonate any user using your system.
    – Bernard
    Commented Feb 24, 2012 at 20:14
  • 3
    My clients had a Windows app with which they could edit any field for any user, say if they got a fax saying that they now had a new phone number. Of course it was audited. Of course when I saw this written procedure taped to the wall near the support desk I was NOT HAPPY. But I came to accept it, and there is an audit trail showing what happened should anyone ever call and complain their password was reset without their consent. The thing is, not everything needs to be this secure. And the users are telling you this doesn't need to be. Commented Feb 24, 2012 at 20:26
  • 1
    Unfortunately, most users don't know any better. It's up to the developers of software applications to enforce best practices.
    – Bernard
    Commented Feb 24, 2012 at 20:36
  • 4
    I agree that this is a big security hole. And I agree that it may be the most appropriate solution. It does however seem incredibly silly for customer support to have to temporarily change the customer's email address to reset that user's password: if you're going to let customer support reset passwords, just let them do it directly. Commented Feb 24, 2012 at 20:47
  • 4
    I would also note that revealing plain-text passwords that users have set (in fact, storing passwords in plain-text at all) is, in my opinion, hugely worse than giving customer support the ability to directly change user passwords. Commented Feb 24, 2012 at 20:53

the method of last resort I used on a system with very illiterate users in the past was to direct the user to a screen where they were given a phone # and a confirmation number. They called the phone number, verified their identity through manual means then read the confirmation. the support person logged into a separate system, entered the number and got a second number to give back to the client. the client used the second code to continue to the reset password page. the client version of the page could not run from the support personnel's sub-nets and the support screen could not run from the clients.

it isn't bulletproof as a support person could use a vpn to run both ends from one location, but it was sufficient for audit since the support account was logged as responsible for the activity


Maybe by implementing security rules that are not INSANE. By doing this, all you're getting is less security really, because the system is so hard to use that your clients will reeval passwords to you and their friends just to get it working!

Can't you just send them NORMAL links, then password below. If the link gets broken by email client just display the form with one field "activation code"... "type activation code you have in the email"... 5 digits so they won't mistake 0 with O, etc. 4 digits are ok for credit cards and you need so complicated policy for simple login? If the code won't work repeat the check with TRIMmed string? I guess it won't make it less secure, right? :)

For me it happens often too... i doubleclick on password and ending space gets copied. It's unbelivable to me why peple can't figure out just to remove ending white chars when the check failed and repeat the process? Then maybe TOGGLE letter casing for me to check if i didn't press CL accidentally.

You have overcomplicated it so badly. It's not "reset password" and "initial password"... but "Confirmation code" and "Enter confirmation number we send you to the email", "Don't have email? It was send to [email protected], check your spam again, still dont have it? Resent your confirmation email". In HTML body a link. http://xxx.com/conf-12345-mymail-gmail-com.html. No mail client will break this.

  • 5
    The security policy he mentioned is not only not "INSANE" but should be a requirement of all "SANE" applications. Links like this sent via e-mail have to expire after awhile to prevent the password from being reset (either by thievery of the link directly, or by stumbling upon it via computer aided algorithm). Passwords probably should be trimmed before validated though. Users ARE stupid. It is Law. The answer isn't to reduce our security measures but to take proactive steps to help ensure our users understand the proper procedures.
    – user43349
    Commented Feb 24, 2012 at 21:03
  • 7
    -1. This is a sane way of doing it, that most sites use. If I issue a "forgot password" on a site, and get an email with my password in plain text, I close my account. Commented Feb 24, 2012 at 21:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.