4

Pinterest has a deactivate my account function.

After user deactivates his account, he gets an email with Reactivate account link:

enter image description here

Here Reactivate button links to login form with username and password.

But is it OK to link user to login form? I think at that point of time web application shouldn't expect user to know password so it would be better to show a form with just Password and Password Confirmation:

mockup

download bmml source – Wireframes created with Balsamiq Mockups

After clicking Unlock my account user would be logged in. I don't see any security vulnerabilities in proposed approach if url to this form contains random unguessable token.

1 Answer 1

1

An 'unguessable' token can always be brute forced. Also, you are emailing the user the link in the first place (which contains the secret reactivation link) - e-mail is hardly secure. These are the reasons Pinterest probably requires you to log back in with your old password (so, to answer your question, yes, you should force the user to log in in order restore their account).

Edit: see the time-sensitive vulnerability regarding password reset e-mails

4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.