thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Insecure Password Recovery

Weak account recovery flows that let attackers reset other users' passwords.

Definition

Weaknesses include knowledge-based security questions, predictable or long-lived reset tokens, tokens not bound to the account, reset links built from the Host header and not invalidating sessions afterwards. Secure designs use single-use, short-lived random tokens sent to a verified channel and notify the user.

Example

A reset flow accepts the answer to 'What city were you born in?', which is found on social media.

Exam tip

Security questions are weak; use time-limited random tokens to a verified channel.

Related terms