Just designing the forgotten password form for a retailer.

When researching other retailers, I've have noticed the temporary password link that gets sent to inbox's expire after a few hours. What is this reason for this?

I'm wondering whether we need to do this or not?

  • 3
    This is probably more about security than UX – Sebastian Negraszus Jul 10 '13 at 9:41
  • 2
    This is mostly a security question, I think. Although you might get some useful info from this question: ux.stackexchange.com/questions/38612/… – JonW Jul 10 '13 at 9:41
  • 4
    I don't see how being a security question make it any less of a UX question. It's like saying that a design question is mostly a usability or sale question, therefore not UX. The way you design a password/identification system is a UX question with consequences for the security of the system (and its usability, and conversion/sales, etc.) – Gala Jul 10 '13 at 10:39
  • 1
    The way I see it, UX is about trade-offs. There is no “optimal” UX solution outside of the constraints of a project (including security constraints). A good answer would describe these trade-offs and their consequences for the design of the system, possibly suggest other ways to address the underlying (security) problem through interaction design. Generally speaking, I have the feeling that all the talk about “good UX” outside of any context and all the questions about this and that widget tend to isolate UX from what makes it challenging and interesting. – Gala Jul 10 '13 at 11:05
  • 1
    By definition: yes. A temporary password cannot not expire? – Marjan Venema Jul 10 '13 at 17:02

The temporary "password" should take the user to a page to allow the user to change their password, but not actually change the password to the temporary one in case someone other than the user requests the password change, it doesn't lock an unsuspecting user out.

The temporary one should expire, even if the site doesn't have "secure" data about the user. It is often possible to get a little information about a user and move on to another site the user uses, getting a little more information, etc. until the hacker has "elevated" enough to get through.

This is a security issue, but it is also a UX issue. When the user's personal life is negatively effected because of poor design from a single web site - this absolutely effect the user's experience in a drastic way.

| improve this answer | |
  • You don't explain the reason, the consequences of doing it differently. That's why I vote your answer down. – mentallurg Jun 9 '19 at 10:34

The main reason is that this temporary password travelled through an unencrypted channel (email) and will possibly remain in a relatively insecure location (the mailbox). Making it expire limits the risk associated with this but also impacts the interaction with the system as it provides an incentive to actually heed the advice to supply a new password instead of relying on finding back the email and the automatically generated password later on.

Another solution to the same problem is to invalidate the previous password and make the temporary password a one-time identification token/link leading to a “change password” page but that's obviously more intrusive and could occasionally backfire.

Yet another approach on the other end of the security-convenience trade-off is to send back the original password but that means storing and transmitting it in unencrypted form. You still occasionnally come across this but security experts strongly warn against storing unencrypted passwords anywhere. Note that people often reuse their passwords so that unsafe practices entail a small risk of exposing your users to serious problems even if your application does not seem particularly critical.

Of course, the ability to request a temporary password by email or through a simple personal question also introduces new risks in itself. That's why financial transactions are usually protected through other measures like a two-factor identification or check-out process that forbid delivery to an unknown address without verifying the credit card again. This is arguably more important than making the password expire.

Finally, one last thing to consider is trust. If people are used to temporary passwords and other security measures, they might expect the same from you lest they consider your company less trustworthy that its competitors. You certainly want your design to give the impression that it's safe doing business with you.

| improve this answer | |
  • Good explanation. – mentallurg Jun 9 '19 at 10:33
  • Downvoted as soon as I saw "send back the original password". This is nearly criminal-level negligence far beyond "generally not recommended". Exposing your users' passwords in plain text over unencrypted channels is not a "small risk", it is a huge and completely needless risk. – Carl Leth Jul 2 '19 at 22:48
  • @CarlLeth I don't think this is completely accurate but I agree password best practices evolved quite a bit and I would not have written that today. I reworded that part of the answer. – Gala Jul 5 '19 at 18:11

The reason is following. When you set your password, nobody has access to it, and this is secure. But when you get a link to reset the password or even you get a temporary password, there is a risk, that somebody gets access to this email with link or with temporary password: Because it may be easier to break user's account, you have no control of passwords of your user for their emails, you have no control email servers of your users, you cannot be sure if your users share their computers with somebody else and somebody else gets access to the user's emails; also the most emails are being sent over unencrypted connections; etc. That's why the sooner the link for password reset expires, the lower is the risk that is will be used by attackers.

| improve this answer | |

The temporary password should absolutely expire. Having two passwords for one account is an inherent risk. Instead, you should have the temporary password take the user to a page where they can change their password. Also, the temp should expire after a short period of time.

| improve this answer | |

I think that the main reason behind it is security. The user should use temporary password to change the password/reset the forgotten password.

If in case the mail is not accessible then at that time the user may have to generate another request for temporary password.

| improve this answer | |
  • You don't explain the reason, the consequences of doing it differently. That's why I vote your answer down. – mentallurg Jun 9 '19 at 10:31

You should do this if your account contains important data which can be misused. Financial and Banking websites usually require high security.

Generally any Forgot Password functionality should have 2 factor authentication. You could ask a security question and then send an email to the registered email address.This password should also be a temporary one and make the user change his password as soon as he has logged in with it.

A temporary password which expires only assumes that the email address has not been compromised yet but could be after the expiry period.

| improve this answer | |
  • You don't explain the reason, the consequences of doing it differently. That's why I vote your answer down. – mentallurg Jun 9 '19 at 10:31

As someone who has done a fair bit of security compliance, I can say the answer is: ask your company's compliance officer.

Probably more important than setting the reset-window time, is ensuring your ping their SMS or other '2nd factor' when resetting. This is important in case someone else is trying to reset to break in. Consider that you can ping their 2nd factor (e.g. SMS) interactively, so that if they respond with 'freeze', or similar, then then you can immediately disable the password reset code.

20-minute resets are generally safe, though be mindful of whether your email deliverablity is good enough for them to get it in that window of time.

presume shorter time windows for financial logins, business SaaS, and similar critical systems. The same goes for social accounts if the account is 'high status' or the request comes from outside the normal activity profile.

| improve this answer | |
  • Your answer may be good for lawyer. What you say means "Don't think about it, don't understand it, just do as document X requires". That's why I vote your answer down. Here on Stack Overflow we try to provide quality answers so that people THINK about WHAT and WHY they do. Based on your experience with compliance requirements, it would be helpful to explain to us here the rationale for these compliance rules. – mentallurg Jun 9 '19 at 10:29
  • Because there are too many different scenarios that could be involved. My answer would be a whole article to comply with your finicky comment trolling. Flagged. – New Alexandria Jun 9 '19 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.