What is a 'best-in-class' credential reset pattern?

Question

When we design secure systems there is always a tension between memorability, security and cost (e.g. Calls to a call centre).

Until recently, I've always tackled this by getting users to set up security questions during registration (first dog's name, etc).

This seems a bit quaint and outdated now, when there are so many ways to verify identity online, yet it still seems the most prevalent pattern. What is the best in class solution right now?

• Criteria 1. There MUST be a way to recover username and/or password digitally as first resort, before calling customer care

• Criteria 2. The question covers both desktop and mobile but the solution doesn't necessarily have to be the same for both

Answer 1

In order of best security:

Universal 2nd Factor (U2F) is the best, in that it has all the advantages of Two Factor Authentication (2FA), but is phishing-proof, as the token won't respond to a challenge from an unknown site. The tokens are reasonably priced.

Next best is Google Authenticator-style 2FA, which requires a smart phone, but works even if your phone is on airplane mode, and incurs no connection costs for the user or your service.

Next best is SMS 2FA, which requires a mobile phone and may incur connection costs for the user or your service.

Next best is non-obvious password reset questions combined with a reset link sent to your email. This is vulnerable if hacker can get access to your email and knows things about you.

Next best is a reset link sent to your email. This is vulnerable if hacker can get access to your email.

You can combine all of the above with browser info + IP geolocation info to determine the riskiness of the reset request. For example, if I always login from Vancouver, but a reset request comes in from St. Petersberg, it mightn't be me.

Answer 2

The only time security questions make sense is if they're used to verify the person on the phone line.

I believe most modern apps seem to have moved onto the "email me the reset password link" approach. It requires much less info for the user to recall.

Here's an example from Twitter:

Reset password page

Email sent to user

One time use reset

This method uses the user's email account to validate their identity, instead of a security question which might be easy for other people to guess or look up. Asking the user to directly enter their own password also avoids having the system generate a temp password that will be stored in plain text within the user's email and prevent the system from accidentally resetting the password if somebody else went in and request for a password reset.

Answer 3

What is 'best in class' (shudder...I despise that term as it's an overused buzzword that executives love to say) is going to likely be mostly opinion based and will depend heavily on a) the type of security you need and b) the willingness of your users to jump through hoops to maintain said security.

All that said, note that your example of security questions can actually do more harm than good. The paradox is that if you make the security question easy to remember, it's also easy for hackers to guess. If you make it difficult to remember, odds are user's will forget those as often as they forget their password.

So I can't really tell you what is the 'best in class' for password resetting, but I would argue that asking for security questions is definitely not going to make it best in class from a security standpoint.

Answer 4

In terms of Security, nothing can beat a Two-Factor Authentication.

If you happen to forget a password, you will need to authenticate twice.

1. Your Security Question/ Email Address Confirmation Link.
2. An One Time Password (OTP) send on your Registered Number.

This helps in the scenario:

You know the answer to the security question of the User and/or the User has compromised his Email. Now, if you happen to answer his question or open his Email ID, you'll still be unable to enter the account unless you have access to the User's text messages. Plus the User will receive an OTP and be warned.