0

When a user forgets their password, is it better practice to reset the password and email that to the user or just to email the current password to the user's email address.

  • 21
    Sending the current password again would imply that you have stored the password in a recoverable format all along, which is a very bad practice to begin with. – Kilian Foth May 22 '15 at 10:54
  • 10
    You should be storing the password salted and hashed, not in plain text form. If you don't even know that, use an existing tool/library rather than trying to roll your own - security is hard! – jonrsharpe May 22 '15 at 11:00
  • 3
    If you don't encrypt or hash your clients' passwords, then anyone who can get access to your database, or even just a backup of your database, can cheerily waltz off with all of those passwords and, potentially, do very Bad Things with them, all of which come back to YOU because you failed to protect the data properly. – Phill W. May 22 '15 at 11:11
  • 7
    No, you should not encrypt the passwords. Any form of encryption implies that they can be decrypted, which is simply unacceptable. They should be salted and hashed with a cryptographically secure hash specifically designed for password hashing. – Jörg W Mittag May 22 '15 at 12:42
  • 2
    See How to securely hash passwords? on security.se. – CodesInChaos May 22 '15 at 14:51
19

You should never be in a position to send a user their password. All passwords should be stored in a hashed format, with a sufficiently good hash function that recovering the original password is computationally infeasible.

As for password resets, it depends on the application. If it's a web application, send a time-limited, use-once password reset link and have the user give you a new password. If it's not a web application, it gets a little bit trickier.

  • Good answer, but worth noting that the suggestion for web applications may be inadequate depending on the sensitivity of the application. A bank should not do it that way, for example. – user82096 May 22 '15 at 11:00
  • It is a web application. Why is it bad to save the password in a recoverable format? – Jason Van Der Meijden May 22 '15 at 11:00
  • 6
    @JasonVanDerMeijden because then the passwords can get stolen! It greatly increases the consequences of someone hacking your website or otherwise getting unauthorized access to your data. – user82096 May 22 '15 at 11:01
  • 1
    @JasonVanDerMeijden In addition to what dan1111 said, the consequences are even more dire for most users who use the same password on multiple sites. Basically if they hack your site you've successfully led the hackers to people's passwords on sites like facebook, gmail etc. – Alternatex May 22 '15 at 23:10
  • 1
    @JasonVanDerMeijden: This is so bad, the fact that you ask the question means that your website should be avoided at all cost. Your employer is negligent for hiring you.Seriously. There is a special part in hell for so-called "developers" who store passwords in a readable format. – gnasher729 Jul 26 '17 at 7:11
-4

it is never good practice to share current password . Its best to reset it with temp password and ask user to generate a new one with its help . This is the best practice being followed reason is if u send the password over mail or sms and in case of account hack etc it will be bigger problem as users normally use same password at multiple places .

  • 2
    this seems to merely repeat points already made and explained in prior answer that was posted over 2 years ago – gnat Jul 26 '17 at 6:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.