php send user password via email

Question

We all know we shouldn't be storing user passwords as plain text on the database. However I have seen some sites that have implemented a send-forgotten-password feature. So if I ask my password, I type my email and they send the password. Note: I'm not talking about a password change ( http://sample.com/forgot_pass?token=ddm39fhksnc )

How do these sites achieve it? They store plain passwords on their databases (maybe a different database) because as far as I know you can't reverse a password hash to the original string it was built from...

Is there anyway this feature can be implemented securely? Or I should convince clients to stick with forgot-pass-link method.

Thanks.

Answer 1

If they are able to send you your password then they are storing your password in plain text.

Note that you can find out the original password from the hash if a deprecated hash function was used (like md5).

There is no way of doing it securely. If your database gets breached the attacker will be able to read out all the passwords and corresponding email addresses/usernames. If your users re-use the same password for different sites (which most people do) what can happen.

Even if there would be a "secure" way of finding out the password from its hash, what stops the attacker from doing the same?

Answer 2

Such a feature cannot be implemented securely. If the application can retrieve the original password (eg from an encrypted password), a successful attacker can retrieve the passwords as well. That's why one should use a hash function like BCrypt, SCrypt or PBKDF2.

Another weakness is sending the password at all per e-mail. A better way is to send a token, and let the user choose his own password after confirmation. The same code can be used to register a new user and to reset a password.

Answer 3

You open the door to major security issues if you store the actual password in the database. But if in fact you must resend their password to them, one way you could do it, is when they register, store the password in a text file located outside of the public directory.

Then create some sort of naming logic that associates the record to the text file. And then from there, make it so the only way you can access that text file is with the proper security checks in place, and then via your script.

Answer 4

My solution is adding two field in table "user" in my database: "token" field and "expired_time" field.

1. When user send a request to reset password, your application will update token string and expired time to reset password for that user.

2. Send an email with link has username (or email, or id,...) and token like http://example.com/resetpassword.php?id=userid&token=token

3. In resetpassword.php, you will check authentication by userid, token and in expired time (maybe 5 minutes)

4. Allow user to change their password.

This is my solution, I hope it'll helpful :)