3

Both of these processes basically do the same thing - they change password. Password change usually by entering old and a new password, forgotten password by typing your mail address to which user then receives link with a token that allows them to set a new password.

Are there any cons to using only the forgotten password process for both actions? Basically - logged in user that wants to change password would click the "change password" button, which would send the link with token to their mail address and notify them about it.

I can imagine mergin both processes could be a little bit confusing for the user, checked couple of apps / sites (facebook, google, slack, asana, basecamp) and none does it, all use the old / new password approach for password change, in fact, I don't think I have ever in my life encountered a site, with these processes merged, are there any other reasons other than old / new being sort of a standard?

  • 1
    I think that the Forgot password is essentially the same as providing access to Change password without the need to log in. So while Change password is a part of Forgot password, it is not the same. – gerstemout Sep 5 '18 at 11:17
2

While they do the same thing, I do not believe it is correct to merge the process. The reason you need to enter your current password is so that third party users of the account can not take over the account.

Example

For instance, I keep Facebook logged in on my PC. If my friends visit my place my computer is usually on standby. If you do not need to enter the current password they can just easily take over the account.

With the 'forgot my password' process you usually need to use your email(which is an extra step that should increase the safety) or you need to enter some answer to a question like 'What was your first pets name'.

Friendly tip: Always have a unique password for your email(s), if someone takes over your most used email you are in a world of trouble.

Both the change current password and the 'i forgot my password' actions use an extra verification step.

When is it possible

It might be possible to merge the process if every website uses 2FA. In the case of an password change you will get a popup on your phone and you have to manually accept the change. But in the example above, my friends can also take over my account with 2FA if I left my phone unlocked.

However I think that 2FA is still not accepted enough. I do encourage companies forcing 2FA, you can use fun methods like Fortnite did.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.