Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

Pinterest has a deactivate my account function.

After user deactivates his account, he gets an email with Reactivate account link:

enter image description here

Here Reactivate button links to login form with username and password.

But is it OK to link user to login form? I think at that point of time web application shouldn't expect user to know password so it would be better to show a form with just Password and Password Confirmation:

mockup

download bmml source – Wireframes created with Balsamiq Mockups

After clicking Unlock my account user would be logged in. I don't see any security vulnerabilities in proposed approach if url to this form contains random unguessable token.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

An 'unguessable' token can always be brute forced. Also, you are emailing the user the link in the first place (which contains the secret reactivation link) - e-mail is hardly secure. These are the reasons Pinterest probably requires you to log back in with your old password (so, to answer your question, yes, you should force the user to log in in order restore their account).

Edit: see the time-sensitive vulnerability regarding password reset e-mails

share|improve this answer
    
If strength of unguessable token is more than 128 bits, bruteforce won't give anything as all computers in the world aren't able to perform so many operations even if they will work tens of years –  Andrey Botalov Mar 29 '13 at 19:10
    
Fine, but you are still emailing the token in plain text to the user over e-mail. –  Joshua Barron Mar 29 '13 at 19:11
    
Email is used to send you a Forgot Password link that is sent in plain text –  Andrey Botalov Mar 29 '13 at 19:11
2  
Such e-mails generally expire after a short duration to limit the security vulnerability. The link sent via this e-mail is open to use indefinitely. –  Joshua Barron Mar 29 '13 at 19:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.