When we design secure systems there is always a tension between memorability, security and cost (e.g. Calls to a call centre).

Until recently, I've always tackled this by getting users to set up security questions during registration (first dog's name, etc).

This seems a bit quaint and outdated now, when there are so many ways to verify identity online, yet it still seems the most prevalent pattern. What is the best in class solution right now?

  • Criteria 1. There MUST be a way to recover username and/or password digitally as first resort, before calling customer care

  • Criteria 2. The question covers both desktop and mobile but the solution doesn't necessarily have to be the same for both

4 Answers 4


In order of best security:

Universal 2nd Factor (U2F) is the best, in that it has all the advantages of Two Factor Authentication (2FA), but is phishing-proof, as the token won't respond to a challenge from an unknown site. The tokens are reasonably priced.

Next best is Google Authenticator-style 2FA, which requires a smart phone, but works even if your phone is on airplane mode, and incurs no connection costs for the user or your service.

Next best is SMS 2FA, which requires a mobile phone and may incur connection costs for the user or your service.

Next best is non-obvious password reset questions combined with a reset link sent to your email. This is vulnerable if hacker can get access to your email and knows things about you.

Next best is a reset link sent to your email. This is vulnerable if hacker can get access to your email.

You can combine all of the above with browser info + IP geolocation info to determine the riskiness of the reset request. For example, if I always login from Vancouver, but a reset request comes in from St. Petersberg, it mightn't be me.


The only time security questions make sense is if they're used to verify the person on the phone line.

I believe most modern apps seem to have moved onto the "email me the reset password link" approach. It requires much less info for the user to recall.

Here's an example from Twitter:

Reset password page

enter image description here

Email sent to user

enter image description here

One time use reset

enter image description here

This method uses the user's email account to validate their identity, instead of a security question which might be easy for other people to guess or look up. Asking the user to directly enter their own password also avoids having the system generate a temp password that will be stored in plain text within the user's email and prevent the system from accidentally resetting the password if somebody else went in and request for a password reset.

  • I'm pretty sure that in the UK you cannot demand phone number or email for registrants. How would the pattern get around this restriction?
    – jackiemb
    Sep 6, 2015 at 13:35
  • 1
    @jackiemb I'm not aware of UK laws. Quick search in google pulls up the PECR. ico.org.uk/for-organisations/guide-to-pecr/introduction/… Which is anti-spam marketing law. Helping your user reset their password isn't marketing. Since you have an existing app, for those who haven't provided email/phone number. Simply prompt them on log in, you have improved security to the app, provide either their email or phone number to switch to the new version.
    – nightning
    Sep 7, 2015 at 15:39

What is 'best in class' (shudder...I despise that term as it's an overused buzzword that executives love to say) is going to likely be mostly opinion based and will depend heavily on a) the type of security you need and b) the willingness of your users to jump through hoops to maintain said security.

All that said, note that your example of security questions can actually do more harm than good. The paradox is that if you make the security question easy to remember, it's also easy for hackers to guess. If you make it difficult to remember, odds are user's will forget those as often as they forget their password.

So I can't really tell you what is the 'best in class' for password resetting, but I would argue that asking for security questions is definitely not going to make it best in class from a security standpoint.


In terms of Security, nothing can beat a Two-Factor Authentication.

If you happen to forget a password, you will need to authenticate twice.

  1. Your Security Question/ Email Address Confirmation Link.
  2. An One Time Password (OTP) send on your Registered Number.

This helps in the scenario:

You know the answer to the security question of the User and/or the User has compromised his Email. Now, if you happen to answer his question or open his Email ID, you'll still be unable to enter the account unless you have access to the User's text messages. Plus the User will receive an OTP and be warned.

  • 1
    Agree 2fa is the best solution in theory. What about if local governance legislation means that you cannot demand users give email or phone number in order to register for a service?
    – jackiemb
    Sep 6, 2015 at 13:40
  • In the case one of them isn't allowed to ask for due to Local Governance Legislation, I guess the way Steam does it is amazing. It sends you an OTP on your email which you need to enter in before the timer ticks out. In this case, it won't be a simple redirect link but an OTP which will need you to enter it in the 180 seconds window. This reduces the gap in which the intruder might access his mail, if he already hasn't. Sep 6, 2015 at 14:10
  • Also, this only happens on Steam if you've logged in through a different IP Address or Location. Also happens when you're hidden behind a VPN. So, location tracking is smart too. Sep 6, 2015 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.