|
Posted by Unruh on August 2, 2006, 6:26 pm
If you were Registered and logged in, you could reply and use other advanced thread options
>I wish to setup an automatic password recovery system on my website,
>like the one most of the sites have nowadays. You need to enter your
>mail-id as provided earlier or answer the secret question. Can anyone
>plz help me to understand exactly how it works and what are the
>possible security threats involved?
The problem is that you need to keep a database of cleartext passwords on
your system. This makes it an ideal hacker target, since people often reuse
their passwords. Thus by grabbing your database, they will have a huge list
of people, their email addresses and their passwords probably to other
systems.
Passwords should always be one way, so that the customer can change their
password with appropriate permission from your system, but cannot be told
their password.
| 
XML site map