291670 - Possible improvement to lost password recovery scheme

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect, P5)

Description

[Jason Chu]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050422 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050422 Firefox/1.0+

In relation to bug 291669, ideally, passwords shouldn't be emailed in plaintext.
 However, when using the current password reset feature, an email is sent to the
user with a new random password in plaintext.  I suggest we "borrow"
Amazon.com's recovery scheme.  After entering the email address, a link with a
unique id (possible about 32 characters or more) is emailed to the user (for
example, recover.php?id=123).  When the link is visited, the user can then set
the password to whatever he wants (with the typical enter password twice box). 
The password is then changed.  The id is no longer valid after the password has
been changed or after some period of time has passed.

This scheme provides two benefits.  The first is that a password is not sent in
plaintext (although the ID is...which is just as useful as the new random
password).  However, the second benefit is that the password is not changed
until the user changes it via the link.  That way, a malicious user can't just
enter everyone's email address to reset everyone's password to a random one
(even though they will have received an email with the new password).  Instead,
everyone will receive an email saying that a request for a password reset was
made and to follow the link which the users can then ignore or whatnot.

Reproducible: Always

Steps to Reproduce:

Comment 1

[alanjstr]

Not security sensitive.

Comment 2

[Dave Miller [:justdave]]

Yeah, we do that with Bugzilla.  We mail them a token, and when they click the
link with the token in it, it lets them set a new password of their choosing.

Comment 3

[alanjstr]

I seem to remember an earlier discussion about using the tokens, but that may
have just been on IRC.  

Comment 4

[Michael Morgan [:morgamic]]

Mass change - bugs to be read / (re)confirmed.

Comment 5

[Cameron]

AMO bugspam. Correcting QA contacts on OLD bugs ([e-mail])

-> Correct QA contact ([e-mail])

Filtermeplzkthx

Comment 6

[Fred Wenzel [:wenzel]]

Actually I didn't know about this bug, but that's exactly the scheme I implemented for Remora.

Therefore marking this fixed.