Should we require confirmation before resetting a password?

Question

If a user has forgotten their password for a service, the convention is that they should need only their username and/or registered email address in order to reset their password -- in our case that means have a new, randomly generated one sent to them.

But, shouldn't services require a confirmation (such as emailing a link to the user) before sending out a new password, in order to verify that it is the owner of the account requesting the password reset?

Usernames are often public information, and email addresses are easily guessed if you have enough information about a person. Without a confirmation, it would be very easy for someone that is not the account owner to reset someone's password for them, which would be a nuisance.

I have seen web services seek confirmation first, and others that simply throw out a new password, regardless of who requested it.

Should we require a confirmation before resetting a password? Are those that don't require a confirmation doing it for a valid, user-friendly reason? Or are they just lazy?

Answer 1

The optimal way to do this is to have your "reset password" feature send an email, which satisfies your "confirm their intent" objective, but instead of that confirmation sending a second email with a new password (security no-no), have the confirmation link take them to a form only accessible from the link in that email; the URL/query string to access this form should expire for security reasons.

Once the user click the link, they should get a form on your website which has two password fields to set themself a new password right there:

^{download bmml source – Wireframes created with Balsamiq Mockups}

The form should have your proper branding/styling and an HTTPS connection to invoke trust (and security). For added security you can send a one-use, time limited code to the user's phone/email to be entered along with the new password, stuff like this is common in more secure apps to prevent access if you've only stolen someone's email/username.

Answer 2

In my opinion, yes you should.

I would allow someone to request a password reset, email the account holder to say "we have received a reset request, if you want to reset your password, click this link..." and when that link is clicked, the new password is generated and sent to them (and perhaps they end up logged in as part of that process, so they can go and change the password straight away)

I'd also have some sort of throttle to that, so nobody can spam password reset requests.

Edit: The above was directed at sites that force passwords on their users. A slight alternative would be after logging the user in after they click the link in the password reset email, you then present them with a form to request input a new password before they can go any further.