"forgot your password"

alewisa · Dec 17, 2002, 10:49 AM

Ok, a fair few sites such as DH, Matrox, etc all have a way of telling you what your password is, in case you forget. Not just forum sites, but others such as FriendsReunited.

What is the technology involved? Obviously a backend database and email. How secure is it, or can it be made more secure (persumably the initial question setup uses SSL or similar)

Is this a realtively easy technology to incorporate, and/or is it available off the shelf? If the later, who sells it? Anyone in the UK?

Need to know quite urgently!

TVIAM
Alan

Matth · Dec 17, 2002, 12:08 PM

Most of the ones where you have an email address assigned to youir account, will do one of two things.

1. Send a password notification for the queried username, to the registered email address for that username

or

2. Send a reset password link to the registered emai for the username

No clever tricks, and I would assume that it's a standard feature of the forum software.

Jeff · Dec 17, 2002, 01:49 PM

vBulletin and Deluxe Portal, for examples, store your password encrypted with MD5, which is a one way encryption, so password recovery with them is more like password reset.

alewisa · Dec 17, 2002, 02:22 PM

Hmm.

There is a reason behind the question. We deploy an application which can be accessed via a browser (it isn't a stricy web based app, however). There are user accounts and passwords, and the greatest number of support calls are from user who have forgotten their passwords (and consequently had accounts locked).

Thus, the integration of a "forgot my pwd" feature would be a mjor boon, reducing the number of support calls, and enabling me to extend the product portfolio that that team support.

tvia
Alan

Jeff · Dec 17, 2002, 05:15 PM

Are the passwords encrypted?

Dec 17, 2002, 10:49 AM	#1
alewisa DriverHeaven Addict Join Date: May 2002 Location: Kendal, UK Posts: 260 Rep Power: 0	"forgot your password" Ok, a fair few sites such as DH, Matrox, etc all have a way of telling you what your password is, in case you forget. Not just forum sites, but others such as FriendsReunited. What is the technology involved? Obviously a backend database and email. How secure is it, or can it be made more secure (persumably the initial question setup uses SSL or similar) Is this a realtively easy technology to incorporate, and/or is it available off the shelf? If the later, who sells it? Anyone in the UK? Need to know quite urgently! TVIAM Alan __________________ TRS-80, dual 5.25", 32K C-64 o/c to 2Mhz, 1541 with PhantomDOS Amiga 4000/040@66Mhz, C64-3D, 64mb, 4.3gb SCSI Netware 4.11 And too many damn PC's to care!

Dec 17, 2002, 01:49 PM	#3
Jeff Yarr... I be blind! Join Date: May 2002 Location: Calgary, Canada Posts: 3,191 Rep Power: 80	vBulletin and Deluxe Portal, for examples, store your password encrypted with MD5, which is a one way encryption, so password recovery with them is more like password reset. __________________

Dec 17, 2002, 02:22 PM	Thread Starter #4
alewisa DriverHeaven Addict Join Date: May 2002 Location: Kendal, UK Posts: 260 Rep Power: 0	Hmm. There is a reason behind the question. We deploy an application which can be accessed via a browser (it isn't a stricy web based app, however). There are user accounts and passwords, and the greatest number of support calls are from user who have forgotten their passwords (and consequently had accounts locked). Thus, the integration of a "forgot my pwd" feature would be a mjor boon, reducing the number of support calls, and enabling me to extend the product portfolio that that team support. tvia Alan __________________ TRS-80, dual 5.25", 32K C-64 o/c to 2Mhz, 1541 with PhantomDOS Amiga 4000/040@66Mhz, C64-3D, 64mb, 4.3gb SCSI Netware 4.11 And too many damn PC's to care!

Dec 17, 2002, 05:15 PM	#5
Jeff Yarr... I be blind! Join Date: May 2002 Location: Calgary, Canada Posts: 3,191 Rep Power: 80	Are the passwords encrypted? __________________

Dec 17, 2002, 12:08 PM	#2
Matth Flash Banner Hater Join Date: Jun 2002 Location: UK Posts: 3,426 Rep Power: 93 System Specs	Most of the ones where you have an email address assigned to youir account, will do one of two things. 1. Send a password notification for the queried username, to the registered email address for that username or 2. Send a reset password link to the registered emai for the username No clever tricks, and I would assume that it's a standard feature of the forum software.