From d6a5101a691cf6260f83d03978f6c9d37d5ea6f5 Mon Sep 17 00:00:00 2001 From: Lars Wirzenius Date: Sun, 31 Mar 2019 18:52:07 +0300 Subject: Add: notion of single-use random link for password resets --- yuck.mdwn | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/yuck.mdwn b/yuck.mdwn index 472504b..6e4f65f 100644 --- a/yuck.mdwn +++ b/yuck.mdwn @@ -167,7 +167,9 @@ reference in discussions. need. * (PRIVACYLEAK) Yuck MUST NOT leak personal information. * (PWRESET) Yuck MUST support the user resetting their password, - securely. + securely. Possibly by supporting a random, single-use link that can + be communicated to the user (perhaps via email) to allow them to + change the password. * (TEMPLOCK) Yuck MUST support locking an account temporarily, if it is the target of too many failures. This is to avoid an attacker from brute-forcing a password by trying many times. -- cgit v1.2.1