1

I have searched and viewed most of the other questions and answers about implementing forgot password functionality on a website.

However, we have a unique situation. When a user registers an account and uses their company-based email as the main email account, how can we implement a forgot password scheme if they no longer work for that company and can't access that email account?

We currently send an email with a reset link to their primary email account. Most do not have a secondary email address and we do not want them to be able to enter just any email address to send the link to.

Is there a design pattern whereby we can have the user enter some information and be taken to a page where they can be allowed to change the email address to send the reset link? BTW, we do not want to use/store security questions.

How has this kind of thing been done before? I don't know of any sites that do this because most of them require to send an email to the user's account.

Improve this question
2
  • 1
    What information do you have for these user accounts? Ultimately if you can't send them an email you'll need to send a text message, or ask questions to verify their identity.
    – Steve Wortham
    Jun 20, 2014 at 22:37
  • Do you know of a library to send the text message without knowing their carrier?
    – MB34
    Jun 24, 2014 at 14:04

1 Answer 1

Reset to default
2

You need to ensure at time of registration there are more ways than one to reach a user. Since you dont want to ask security questions, we will stick with secondary information provided by the user. Make it mandatory to provide at least one secondary email address and a phone number at time of registration. Allow users to add as many additional email/phone number to be linked with this account (After sending verification mail/text pins and verifying the added objects)

So in the case of user forgetting a password, you can ask him to choose which mode he want to retrieve his password.

NOTE : You do need to provide alerts to all the modes of communication linked when a user tries to change password. This is to ensure that even when one of his emails/phone is jeopardized he can still regain control of his account.This method is currently employed in banking websites where the user has to be aware of the activities of his account.

In your case now , if this has not been implemented earlier, as @'Steve Wortham' said, what data do you have of the user through which you can validate that he is indeed the person who he claims to be. Use those to give him back his control.

Improve this answer
10
  • We do ask for business and cell phone numbers, plus several other identifying fields, such as Employer, Job Title. We used to ask for Last4SSN but have opened up for int'l. registrations so we no longer ask for that. We are asking more for what techniques to use to change a user's EMAIL address if they do not remember their password.
    – MB34
    Jun 23, 2014 at 13:46
  • On another note, implementing something now would not benefit the 300,000 user that we currently have in this matter.
    – MB34
    Jun 23, 2014 at 17:58
  • Ah I think given the constraints, the best option would be to send him a text message via phone to a one time link for password reset.
    – Abhilash
    Jun 24, 2014 at 2:01
  • As for the rest of the users, I believe you can still implement the functionality of adding secondary emails and allow them the option of choosing which email is primary (users can toggle between them at any time). This simplifies the process when it comes to sending password reset mails to those who's business accounts have been deactivated
    – Abhilash
    Jun 24, 2014 at 2:03
  • how do I send the Text Message if I don't know what carrier they use and when do I let the current users select which email to be primary much less let them enter a secondary email? What to do when they only have one email address, too?
    – MB34
    Jun 24, 2014 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.