All geek questions in one place

Web Application Security Best Practices

I am working on web applications where - believe it or not - users are not required to provide their email address to register. These requirements cannot be changed. Users will be logged in with an identifier and password, like any standard website. The problem I am facing is that the user has forgotten his password. When they want to create a new one, how can I verify their identity?

Initially, I was going to get users to select a secret question (from list 5) and give an answer. If they ever went to the Forgot Password page, they would have to enter their login ID, as well as the answer to their security question. This seems a little unsafe, since the answer to these types of questions (mother’s name, city of birth, etc.) is usually not so difficult to obtain.

So here are some of my questions:

  • Are security issues the best approach to this problem?
  • If so, what are your best questions?
  • How many questions does the user need to enter answers?
  • Do I need to put CAPTCHA on the Forgot Password page?
  • Is it better for users to create their own questions?

Any help / comments / literature on this subject would be greatly appreciated.

+3
2

?

( , OpenID ..), , . , " " .

  • , ?
  • ?

, , " " " ". , () / , , , .

?

. /.

CAPTCHA " "?

, - , . , SO: reCAPTCHA

+2

, Google , , , Q & . ( ) . , , . 1 . , , , , , ( - 30% - 3- ).

, , , 8 26 .

, , . , - ? , , , reset ( , ). , .

!

0

Source: https://habr.com/ru/post/1712493/

More articles:


All Articles