Change password after clicking on reset link in email

[keith10456]

+1

[Pony99CA]

Have anyone been to a site there you answer a question when you change your password? (to prevent bots from doing it)

Do you mean a CAPTCHA or a security question? CAPTCHAs can be verified automatically, but security questions are usually chosen by the user and would require new User Control Panel settings.

Steve

[Danielx64]

Yes CAPTCHAs

[Alien_Time]

Have anyone been to a site there you answer a question when you change your password? (to prevent bots from doing it)

That extra step is not gonna help and infact it can be a pain. First of all, captcha's are not that hard for bots to crack now a days. Also since the activations email link is only gonna be emailed to the users registered email address, bots can only do that for their accounts. I don't see a need for an additional question on that screen.

[Master_Cylinder]

Some bots can also figure out some simple Q&A tests like 2+2 = ? Or what is the capital of X?

[Danielx64]

Some bots can also figure out some simple Q&A tests like 2+2 = ? Or what is the capital of X?

That's why you do not pick questions like that.

[Master_Cylinder]

Some bots can also figure out some simple Q&A tests like 2+2 = ? Or what is the capital of X?

That's why you do not pick questions like that.

I don't but some people do. Doesn't change the fact that neither captcha nor Q&A are secure anymore.

[Ger]

Q&A is safe. Bad questions are not.

Having a Q&A with a question like "2+2" is like having a lock with the key in it. That doesn't make it a bad lock. The owner is just foolish.

[Master_Cylinder]

You can't force admins into writing better Q&A questions, especially if they don't know better, so it's not safe. You can blame the admin but it still has potential issues. The better password recovery type Q&A systems even allow the user to write their own questions but there would be nothing to stop a user from writing a bad question there either.

Perhaps if phpBB came up with 10 decent "default" questions and allowed users to write their own as one of the options it would be safer but there is still no guarantee that the users email system hasn't been compromised either. I suppose specialty situations can just be dealt with manually by an admin.

[Master_Cylinder]

New way:
User forget password -> request new password->clicks on link in email-> Get taken to a page where he can type in a new password -> login with new password.

I think that this is a better way than what https://area51.phpbb.com/phpBB/viewtopi ... 13&t=44919 was trying to do.

Did this get approved yet?