通过电子邮件发送临时密码来重置密码 [英] Password reset by emailing temporary passwords

问题描述

我公司的一个小组正在为我们的应用程序实现单点登录REST API.此身份验证服务具有密码重置功能.应用程序将用户名发送到重置功能.如果该用户名与电子邮件地址相关联，则会使用临时密码将电子邮件发送到该地址.

A group in my company is implementing a single-sign-on REST API for our applications. This authentication service has a password reset function. The application sends the username to the reset function. If that username is associated with an email address, then an email is sent to that address with a temporary password.

另一种方法似乎是通过电子邮件发送安全的临时链接的网站，该链接为用户提供了一个页面，供用户输入新密码.该页面仅存在很短的时间.

The other approach seems to be sites which email a secure, temporary link which presents a page for the user to input a new password. This page only exists for a short period of time.

我知道电子邮件不是安全协议，因此人们可以嗅探流量并恢复临时密码或临时链接.

I know that email is not a secure protocol, so people could sniff the traffic and recover either the temporary password or the temporary link.

是否有任何重要的安全原因偏爱一种方法?还有另一种更安全的方法可以做到这一点吗?

Are there any significant security reasons to prefer one method over the other? Is there another, more secure way to do this?

推荐答案

在两种情况下，私有信息(临时密码或重置链接)都在同一介质上传输.从这个角度来看，安全性没有区别.但是，重置链接具有一些优点:您可以强制用户选择新密码.他这样做后，链接将立即失效并且不能被滥用.相反，临时密码往往不是您想要的那样临时.即使您强迫用户在下次登录时选择新密码，他也可能会再次输入临时密码.

In both cases, the private information (temporary password or reset link) is transmitted over the same medium. From this point of view, there's no difference in security. However, the reset link as a few advantages: You force the user to choose a new password. As soon as he does so, the link is void and cannot be abused. Temporary passwords, on the contrary, tend to be not as temporary as you like. Even if you force the user to choose a new password on the next logon, he is likely to enter the temporary one again.

此外，您可以记录使用重置链接的用户的IP，因此如有必要，至少可以将其移交给管理机构.

Additionally, you can log the IP of the one who uses the reset link, so have at least something to hand over to the authorities if necessary.

这篇关于通过电子邮件发送临时密码来重置密码的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！