Web Penetration Testing with Kali Linux - Third Edition

Recovery instead of reset

When facing the question of what to do when a user forgets their password, you can choose between two main options:

• Allow them to recover the old password
• Allow them to reset it

The fact that an application allows a user to recover their old password presumes some security flaws in the application's design:

• Passwords are stored in a recoverable manner in the database instead of using a one-way hashing algorithm, which is the best practice for storing passwords.
• In the server-side code, a customer service agent or the system administrator can recover the password. An attacker may also be able to do this through social engineering or technical exploitation.
• The password is put at risk when communicated back to the ...