0

When a user forgets their password, is it better practice to reset the password and email that to the user or just to email the current password to the user's email address.

10
  • 21
    Sending the current password again would imply that you have stored the password in a recoverable format all along, which is a very bad practice to begin with. May 22, 2015 at 10:54
  • 10
    You should be storing the password salted and hashed, not in plain text form. If you don't even know that, use an existing tool/library rather than trying to roll your own - security is hard!
    – jonrsharpe
    May 22, 2015 at 11:00
  • 3
    If you don't encrypt or hash your clients' passwords, then anyone who can get access to your database, or even just a backup of your database, can cheerily waltz off with all of those passwords and, potentially, do very Bad Things with them, all of which come back to YOU because you failed to protect the data properly.
    – Phill W.
    May 22, 2015 at 11:11
  • 7
    No, you should not encrypt the passwords. Any form of encryption implies that they can be decrypted, which is simply unacceptable. They should be salted and hashed with a cryptographically secure hash specifically designed for password hashing. May 22, 2015 at 12:42
  • 2
    See How to securely hash passwords? on security.se. May 22, 2015 at 14:51

2 Answers 2

19

You should never be in a position to send a user their password. All passwords should be stored in a hashed format, with a sufficiently good hash function that recovering the original password is computationally infeasible.

As for password resets, it depends on the application. If it's a web application, send a time-limited, use-once password reset link and have the user give you a new password. If it's not a web application, it gets a little bit trickier.

5
  • Good answer, but worth noting that the suggestion for web applications may be inadequate depending on the sensitivity of the application. A bank should not do it that way, for example.
    – user82096
    May 22, 2015 at 11:00
  • It is a web application. Why is it bad to save the password in a recoverable format? May 22, 2015 at 11:00
  • 6
    @JasonVanDerMeijden because then the passwords can get stolen! It greatly increases the consequences of someone hacking your website or otherwise getting unauthorized access to your data.
    – user82096
    May 22, 2015 at 11:01
  • 1
    @JasonVanDerMeijden In addition to what dan1111 said, the consequences are even more dire for most users who use the same password on multiple sites. Basically if they hack your site you've successfully led the hackers to people's passwords on sites like facebook, gmail etc.
    – Alternatex
    May 22, 2015 at 23:10
  • 1
    @JasonVanDerMeijden: This is so bad, the fact that you ask the question means that your website should be avoided at all cost. Your employer is negligent for hiring you.Seriously. There is a special part in hell for so-called "developers" who store passwords in a readable format.
    – gnasher729
    Jul 26, 2017 at 7:11
-4

it is never good practice to share current password . Its best to reset it with temp password and ask user to generate a new one with its help . This is the best practice being followed reason is if u send the password over mail or sms and in case of account hack etc it will be bigger problem as users normally use same password at multiple places .

1
  • 2
    this seems to merely repeat points already made and explained in prior answer that was posted over 2 years ago
    – gnat
    Jul 26, 2017 at 6:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.