Re: best practices for user friendly and secure forgotten password resolution

What I have seen is other apps is that the system will say "If the email
address you entered is in our system, we have sent you a password reminder
email. If you do not receive an email within 1 hour, we do not have the
email address entered in our system and you should try again using another
email address".

This is the best i have seen so far as the user is given SOME indication
that the email they entered isnt valid if they dont get an email from the
system in a certain time frame. I dont think it's a great solution, but
until I see something better, this is the model my company uses.

-carrie


On Fri, Aug 21, 2009 at 2:29 PM, Laura Malone <[email protected]> wrote:

> Hi all,
> The use case I'm asking for input on is this: The user has forgotten their
> password and types in an email address that is not in our system. Currently
> we tell them that we don't have that email address in our system and to try
> another or register. However, we have been mandated to address the security
> issues around this approach. Apparently, by telling the user we don't have
> that email address in their system allows a hacker/attacher to keep trying
> other email addresses until they get a match.
> So in other words, there is a conflict between the ease of use in telling a
> user who has forgotten their password that we don't have their email address
> in our system vs. the potential breech of security that this messaging
> apparently invites.
> My question is, have you resolved this conflict in your website, and if so,
> how?
> Thanks for any insight,
> Laur Malone
> _______________________________________________
> This is the BayCHI Discussions mailing list, [email protected]
> To change your subscription options, or to unsubscribe, visit
> http://baychi.org/mailman/listinfo/discussions
_______________________________________________
This is the BayCHI Discussions mailing list, [email protected]
To change your subscription options, or to unsubscribe, visit http://baychi.org/mailman/listinfo/discussions