Web password recovery --- a necessary evil?

TL;DR

This paper analyzes web password recovery systems, providing a framework for systematic evaluation and offering recommendations to enhance security while acknowledging inherent vulnerabilities.

Contribution

It introduces a comprehensive model for analyzing web password recovery and offers guidelines for secure implementation.

Findings

Identifies key vulnerabilities in password recovery systems

Proposes best practices for secure implementation

Highlights areas for future research

Abstract

Web password recovery, enabling a user who forgets their password to re-establish a shared secret with a website, is very widely implemented. However, use of such a fall-back system brings with it additional vulnerabilities to user authentication. This paper provides a framework within which such systems can be analysed systematically, and uses this to help gain a better understanding of how such systems are best implemented. To this end, a model for web password recovery is given, and existing techniques are documented and analysed within the context of this model. This leads naturally to a set of recommendations governing how such systems should be implemented to maximise security. A range of issues for further research are also highlighted.