Visible to the public Email-Based Password Recovery - Risking or Rescuing Users?

TitleEmail-Based Password Recovery - Risking or Rescuing Users?
Publication TypeConference Paper
Year of Publication2018
AuthorsMaqbali, F. A., Mitchell, C. J.
Conference Name2018 International Carnahan Conference on Security Technology (ICCST)
Keywordsauthentication, authorisation, content and design of email-based password recovery, content issues, Electronic mail, email content, email-based password recovery, English language websites, entire user-website relationship, message authentication, password, password recovery, password recovery email, pubcrawl, resilience, Resiliency, secret link, secret passwords, security problem, shared secret, System recovery, telecommunication security, Unsolicited electronic mail, usability, user authentication, user instructions, web services, Web sites
AbstractSecret passwords are very widely used for user authentication to websites, despite their known shortcomings. Most websites using passwords also implement password recovery to allow users to re-establish a shared secret if the existing value is forgotten; many such systems involve sending a password recovery email to the user, e.g. containing a secret link. The security of password recovery, and hence the entire user-website relationship, depends on the email being acted upon correctly; unfortunately, as we show, such emails are not always designed to maximise security and can introduce vulnerabilities into recovery. To understand better this serious practical security problem, we surveyed password recovery emails for 50 of the top English language websites. We investigated a range of security and usability issues for such emails, covering their design, structure and content (including the nature of the user instructions), the techniques used to recover the password, and variations in email content from one web service to another. Many well-known web services, including Facebook, Dropbox, and Microsoft, suffer from recovery email design, structure and content issues. This is, to our knowledge, the first study of its type reported in the literature. This study has enabled us to formulate a set of recommendations for the design of such emails.
DOI10.1109/CCST.2018.8585576
Citation Keymaqbali_email-based_2018