Page MenuHomeWrite.as

Password resetting
Open, Medium-HighPublic

Description

Overview

Allow user to reset their password with an emailed link.

Background

This is happening more frequently.

Implementation

Add "forgot password?" link to login page and Pad dialog. Ask for email address (?).

Heavily rate-limit submitted requests.

Handle different cases:

  • User has an email and password set: mention that they can log in via email (and link to guide), and that an email with a reset link has been sent to them.
  • User only has an email set: mention that they don't have a password set, and can log in via email (link to guide)
  • User only has a password set or email doesn't exist: mention that an email with a reset link has been sent to them.
  • User has no email or password set: mention this and tell them to message us (perhaps pop up chat window)

Email should contain a link with a sudo=1 one-time auth-token that redirects them to /me/settings?pass and only prompts them to pick a new password. Also include the username field so browsers update their saved passwords.

Revisions and Commits

Related Objects

StatusAssignedTask
Openmatt
Resolvedrobjloranger
OpenNone

Event Timeline

matt triaged this task as High priority.Jan 22 2018, 5:53 AM
matt created this task.
matt added a parent task: Restricted Maniphest Task.
matt added a project: Restricted Project.Jan 29 2018, 2:28 AM
matt changed the visibility from "Restricted Project (Project)" to "Public (No Login Required)".Nov 18 2018, 8:21 PM
matt edited projects, added WriteFreely (v1.0); removed WriteFreely.

I may be betraying my inexperience with the project, but a question about this case:

  • User only has a password set or email doesn't exist: mention that an email with a reset link has been sent to them.

How do we send email with a reset link if they haven't set an email or if the email they provided doesn't exist in the system?

If someone can establish an account without an email address, it might be worthwhile to set up a "paper key" in the event that they lose their password. The idea is that it would be a separate string, generated by the server, that the user should store separately from their password (on a separate device, perhaps on a slip of paper with other important documents, hence the name). If they lose access to their password, the user can then use the paper key to prove their identity and generate a new one.

matt edited projects, added WriteFreely; removed WriteFreely (v1.0).

I like the paper key idea, or even a set of recovery keys. Usually 8-12 random keys that the user prints or writes down. Then when needed they use one in place of a password, and are directed to set a new password. These are single use.

matt added a commit: Restricted Diffusion Commit.Jan 3 2020, 5:26 PM
matt added commits: Restricted Diffusion Commit, Restricted Diffusion Commit.May 30 2020, 2:52 PM
matt added a project: Restricted Project.Aug 4 2020, 2:08 PM
matt lowered the priority of this task from High to Medium-High.Fri, Sep 11, 10:38 AM