https://www.troyhunt.com/everything-you-ever-wanted-to-know/
"Recently I’ve had a couple of opportunities to think again about how a secure
password reset function should operate, firstly whilst building this
functionality into ASafaWeb and secondly when giving some direction for someone
else doing a similar thing. In that second instance, I wanted to point them to
a canonical resource on the ins and outs of securely implementing a reset
function. Problem is though, there isn’t one, at least not covering everything
I believe is important. So here it is.
You see, the world of forgotten passwords is actually a little murky. There are
plenty of different perfectly legitimate angles and a bunch of pretty bad ones
as well. Chances are you’ve experienced each many times as an end user so let
me try and draw on some of these examples to see who’s doing it well, who’s not
and what you need to focus on to get it right in your app."
Via Esther Schindler.
Share and enjoy,
*** Xanni ***
--
mailto:xanni@xanadu.net Andrew Pam
http://xanadu.com.au/ Chief Scientist, Xanadu
https://glasswings.com.au/ Partner, Glass Wings
https://sericyb.com.au/ Manager, Serious Cybernetics
