0

I'm developing an app in which the user can set a password for it so it has to be entered if the app is desired to be accessed. That password is just for their own use of the application if they wish to not allow access to it easily, so I don't store them in a server, it's stored in their own device in a hidden way.

At first, I had though about implementing the typical resending of the password to a email they have initially defined, but this supposes a big problem, any hacker will be able to easily get the user and password of the mail server by studying the code via a disassembler, that's a huge security fail, only way to be solved would be to convert the device in a mail server itself, which is a lot of job that is not worth it.

I had thought about implementing the secret question that was highly used some years ago, but maybe some other ways are possible that are user-friendly.

Which would be these ways, if any?

  • I have never heard of an app that sends emails directly using a mail server. It should always go through your own server using some simple api. Also, the standard way of managing lost passwords is by resetting passwords via email. – filip Aug 9 '18 at 6:24
2

You can allow password reset via mobile number.

Step One: User creates account using username / email + password. Password is stored in phone. Username is stored in remote server.

Step Two: User enters their phone number. The phone number is verified using a short-lifespan code. The server stores the phone number against the username / email.

Step Three: User forgets their password.

Step Four: User clicks: I forgot my password.

Step Five: User is asked to enter phone number.

Step Six: Server generates a short-lifespan code to verify the phone.

Step Seven: Secret code is validated and user is allowed to reset the password thereby granting access to the app.

I hope this route can help.

1

On a mobile phone, if the user forgets their PIN or other security credentials, then the only way to restore access is to do a factory reset. Maybe you could use a similar approach with your app - if the user loses their password then they can reset it, but this will also clear any stored data (so it's as if they'd uninstalled and reinstalled the app).

Of course, you need to warn the user very clearly that this will happen. You should also warn them when they first set up the password that this will be the consequence if they lose it.

0

Interesting question. I am assuming that the app is used on mobile. There can be multiple ways to retrieve passwords, hassle-free and quick. The resetting of the password must be as QUICK as possible.

1. Make the passwords less complex and difficult to forget

There are apps that allow users to set a 4-digit M-PIN (mobile pin). These PIN numbers are easy to remember as users set it on multiple devices the same PIN. And 4 digits are easier to remember.

  1. Remove Passwords with OTPs

Remembering passwords and can be really challenging. Specially when the complexity is added in the passwords. The One Time Passwords (OTP) can be really handy.

So, I want to log in, enter the username and click generate OTP. Your system reads it, enters the OTP and logs you in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.