0

I'm looking for analyzing if giving a temporal password when some user forgets its actual password and requires to log into an application (in my case, it's a Web application) is a good idea.

From my point of view, at the end of the day, either if you send a link to user's email inbox which opens a special page to type and re-type a new password, or just send a one-time-use temporal password to let user enter to its profile settings and change its password, we're talking about the same process.

If I need to find a con about the temporal password approach, I would say the user will need to copy and paste that password in the login box, while a link to set a new password let's enter a new password directly.

Anyway, I find a big advantage when I think about the temporal password approach: both when you want to change your password or you forgot your password, you're configuring your password in the same profile screen.

Why I shouldn't use the temporal password approach? Am I missing something?

Update

I forgot to say that the whole temporal password has expiration. It can be used once, and it will expire - for example - in 1 hour.

Improve this question
5
  • I have seen that sometimes both these approaches are combined. You get a temporary password and a recovery link.
    – JaDogg
    Commented Jul 16, 2014 at 17:36
  • @BhathiyaPerera And what would be the point of combining both approaches?
    – Matías Fidemraizer
    Commented Jul 16, 2014 at 17:37
  • I said I have seen it. Was not a suggestion. Sorry if it was confusing.
    – JaDogg
    Commented Jul 16, 2014 at 17:42
  • @BhathiyaPerera I was asking for your opinion :) I know you weren't suggesting it
    – Matías Fidemraizer
    Commented Jul 16, 2014 at 17:47
  • Link is easier to use. Temp is easier to implement. Also some users use third party software to generate new secure passwords and remember them. Optional : I would also suggest that you make sure the form is compatible with password manager software as well.
    – JaDogg
    Commented Jul 16, 2014 at 18:06

1 Answer 1

Reset to default
2

Consistency is important in an application, but it is often overplayed. You cite the fact that they change their password in the same place as a big advantage, but I'd say that no matter what you do, they're entering a password two times into two separate boxes on the screen.

I would go with the one-time special link approach. It takes them right to changing their password and they're done. With a temporary password, I assume they would have to log in as normal, go to their profile, enter the temporary password as the "old" password and enter their new password in the new password fields. Neither approach is any more intuitive than the other as far as I'm concerned, so I would suggest going with the faster one.

Improve this answer
2
  • I've thought more about this topic. Maybe recovery link works in a Web app, but if this Web app turns into a mobile app, then temp password should work better. What do you think?
    – Matías Fidemraizer
    Commented Jul 17, 2014 at 14:13
  • I'd say so. In that case, they'd be changing their password in the mobile app, which would probably make the most sense to them.
    – SethGunnells
    Commented Jul 19, 2014 at 6:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.