16) Storing them encrypted with a "reset my password" featur
16) Storing them encrypted with a "reset my password" feature that emails a new random password reset URL. That URL times-out after 24-36 hours or gets removed if another request is made during the timeout period. If the URL never gets used, the reset never happens, but if it does get used, the password is reset by the requestor on that page. Also, limit the number of requests per day, to evade a Mail DoS.
I hate reminder based password crap, never want someone to have to service my own problems. Let me take care of mine.
--
[link|mailto:greg@gregfolkert.net|greg],
[link|http://www.iwethey.org/ed_curry|REMEMBER ED CURRY!] @
iwetheyNo matter how much Microsoft supporters whine about how Linux and other operating systems have just as many bugs as their operating systems do, the bottom line is that the serious, gut-wrenching problems happen on Windows, not on Linux, not on Mac OS. -- [link|http://www.eweek.com/article2/0,1759,1622086,00.asp|source]Here is an example: [link|http://www.greymagic.com/security/advisories/gm001-ie/|Executing arbitrary commands without Active Scripting or ActiveX when using Windows]
Edited by
folkert
Nov. 30, 2004, 06:38:09 PM EST
4) Storing them encrypted with a "reset my password" feature
4) Storing them encrypted with a "reset my password" feature that emails a new random password reset URL. That URL times-out after 24-36 hours or gets removed if another request is made during the timeout period. If the URL never gets used, the reset never happens, but if it does get used, the password is reset by the requestor on that page.
I hate reminder based password crap, never want someone to have to service my own problems. Let me take care of mine.
--
[link|mailto:greg@gregfolkert.net|greg],
[link|http://www.iwethey.org/ed_curry|REMEMBER ED CURRY!] @
iwetheyNo matter how much Microsoft supporters whine about how Linux and other operating systems have just as many bugs as their operating systems do, the bottom line is that the serious, gut-wrenching problems happen on Windows, not on Linux, not on Mac OS. -- [link|http://www.eweek.com/article2/0,1759,1622086,00.asp|source]Here is an example: [link|http://www.greymagic.com/security/advisories/gm001-ie/|Executing arbitrary commands without Active Scripting or ActiveX when using Windows]
