DanielHardy Posted June 12, 2012 Share Posted June 12, 2012 Hi, I am looking for some general advice on whether this is good practice for a forgot password script. Firstly when a user clicks "forgot password" they are taken to a page where they are asked to enter their email and their security question answer. Upon success, a randomly generated password is created and sent in normal format in an email to users email, and stored in the database (overwriting their old password) in MD5 format. Thanks in advance Dan Quote Link to comment Share on other sites More sharing options...
abdfahim Posted June 12, 2012 Share Posted June 12, 2012 I personally don't like this security question answer method (because I never could remember those of any of my web accounts). And if the security answer is is too straight forward, then there is no point of having it. So what I did for my designed forums, - when a user click on "forget password" link, it will ask for the email address. - If email address matches, it will create a temporary key in database against that user and send a specific link with hashed (md5) key as argument to his email address. - If he clicked on that link, it matches the key and then asked for a new password. Quote Link to comment Share on other sites More sharing options...
cpd Posted June 12, 2012 Share Posted June 12, 2012 Storing an MD5 hash isn't really that secure. You'd want to look at encrypting your passwords not just hashing. And yes, they are good as it prevents any manual administration. Quote Link to comment Share on other sites More sharing options...
floridaflatlander Posted June 12, 2012 Share Posted June 12, 2012 Storing an MD5 hash isn't really that secure. You'd want to look at encrypting your passwords not just hashing. I think he's talking about a key, specific link with hashed (md5) key as argument to his email address, not a password. Quote Link to comment Share on other sites More sharing options...
Mahngiel Posted June 12, 2012 Share Posted June 12, 2012 I personally don't like this security question answer method (because I never could remember those of any of my web accounts). And if the security answer is is too straight forward, then there is no point of having it. So what I did for my designed forums, - when a user click on "forget password" link, it will ask for the email address. - If email address matches, it will create a temporary key in database against that user and send a specific link with hashed (md5) key as argument to his email address. - If he clicked on that link, it matches the key and then asked for a new password. Yea, I agree with this method. I use the sesssion_id hash as the temporary key for the link and verification. The key is stored in the user's activation column, where normally is a bool integer. Quote Link to comment Share on other sites More sharing options...
floridaflatlander Posted June 12, 2012 Share Posted June 12, 2012 ..... The key is stored in the user's activation column, where normally is a bool integer. Mahngiel, do you have a time column to make the hash only usable within a certain time? I've been toying with this in my mind but I'm not wanting to make another column for time. Quote Link to comment Share on other sites More sharing options...
abdfahim Posted June 12, 2012 Share Posted June 12, 2012 Yea, I agree with this method. I use the sesssion_id hash as the temporary key for the link and verification. The key is stored in the user's activation column, where normally is a bool integer. looks like we are on the exactly same page .... ..... The key is stored in the user's activation column, where normally is a bool integer. Mahngiel, do you have a time column to make the hash only usable within a certain time? I've been toying with this in my mind but I'm not wanting to make another column for time. you have 2 choice ... either insert another column in DB for time stamp, but I prefer to embed the expiration time stamp inside that key ...... Quote Link to comment Share on other sites More sharing options...
floridaflatlander Posted June 12, 2012 Share Posted June 12, 2012 you have 2 choice ... either insert another column in DB for time stamp, but I prefer to embed the expiration time stamp inside that key ...... Haven't thought about that, thanks. Quote Link to comment Share on other sites More sharing options...
Mahngiel Posted June 12, 2012 Share Posted June 12, 2012 but I prefer to embed the expiration time stamp inside that key ...... Interesting concept. Mahngiel, do you have a time column to make the hash only usable within a certain time? I'm not quite too sure what purpose this would serve. There are other ways to determine if the the request was not malicious, and what would be the alternative on expiration? Return the column to true? IMO this just creates an exploit for scavengers. No, I believe a reporting avenue would suffice this situne. Quote Link to comment Share on other sites More sharing options...
DanielHardy Posted June 13, 2012 Author Share Posted June 13, 2012 Thanks for the input guys. I'll give abdbuet's method a go and let you know my results. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.