2

During the password recovery process, once the OTP is sent to a user, why isn't the session suspended if the user navigates to another page in the meantime?

For example, if you try the Forgotten Password option in Facebook, you will see that even if you go to the Facebook landing page and then come back to the OTP code page, you will still be able to enter the OTP token and recover your password.

Wasn't the process supposed to be suspended if the user navigates to another page?

enter image description here

Improve this question
1
  • 1
    I would ask what the concern is if the user navigates away while waiting for the OTP. It doesn't seem like visiting another page on the site makes login less secure.
    – Izquierdo
    Jun 9 at 22:48

1 Answer 1

Reset to default
0

This is quite common, and it strictly depends on teh security policies for each company. There are a few reasons why the password recovery process might not be suspended when a user navigates to another page.

  • Session timeout: Some websites have a session timeout policy that automatically expires a user's session after a certain period of inactivity. This helps to prevent unauthorized access to user accounts. However, if the user is only navigating to another page on the same website, their session will not expire and they will be able to continue with the password recovery process.
  • Security: Some websites choose not to suspend the password recovery process because they believe it would make it more difficult for users to recover their passwords. If a user's session were suspended, they would have to start the entire process over again, which could be frustrating and time-consuming.
  • Convenience: Some websites prioritize convenience over security. They may choose not to suspend the password recovery process because they want to make it as easy as possible for users to regain access to their accounts.

Now, I don't know why Facebook, doe sthis, but I assume they decided that the convenience of allowing users to continue with the password recovery process even if they navigate to another page is more important than the security risk of someone else being able to use the OTP token. For example, what if the token arrives by email and they navigate to Gmail? If the OTP is cancelled, then the user will need to do the whole process again until he realizes he must open Gmail on another window or check in another device.

But again: this depends on each companie's policies, other websites have different policies and they actually stop the process, just like you say.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.