I'm developing a site (not PW) and I told to one of my non-tech relative how the Reset password feature works:
- ask the user's email
- send a link with code to the given email
- the user clicks on the link in his email and gets to a form where he can enter a new password
His first reaction was that it is insecure because if someone hacks the user's email account he can request a new password on my site and so he can login.
I'm not sure if a developer should take care of such cases. On the other hand, it is also my duty to prevent unauthorized access. I have checked some other sites and they used the same method as I.
I could prevent this with "What's your favorite colour?" type questions that the user answered when he registered, and only send out the email if the answer matches. This is also problematic, because he may forget the right answer.
What's your opinion?