Forgotten passwords

Posts

Forgotten passwords

3/10/24, 12:51 PM Edited #1

admin
Site Dictator
Offline
1,112 posts

Registered: 7/7/23

This puzzle concerns the process of resetting login information through a "Forgot Password" feature. In our forum system, users are prompted to input their email address. If the system locates the email in its database, it sends instructions via email. However, if there's no match found, it refrains from indicating this. From a security perspective, why might this approach be advisable?

Re: Forgotten passwords

3/10/24, 4:56 PM Solution #2

Bill Howatt
Master Craftsman
Offline
2,773 posts

Registered: 1/3/04

If you assume the login attempt is hacking then not giving an indication of why there is no response to the request provides the hacker with less information to base another attempt on. Of course, like all security stuff, it makes it more difficult for a legitimate user, In this case for example, if the email of record is bad or out-of-date, or some other issue.