Your company is selling toys online and shipping globally. When signing in to the web site, a customer, Jack, forgot his password. He clicked the “Forgot password?” button to reset his password and received a password notification email in 2 minutes that provided his old password for him to sign in. Jack called the customer service to complain about the insecure web system because of receiving the password notification email. As a security professional, which of the following is the best suggestion?
A. Implement a self-service portal to reset password
B. Accelerate the delivery speed of password notification emails
C. Employ a one-way function to handle passwords and concatenated random strings
D. Use AES256 to encrypt passwords with salts
Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.
My suggested answer is C. Employ a one-way function to handle passwords and concatenated random strings.
Define the Problem First
Jack complained about the insecure web system because his old password is either unencrypted (cleartext) or reversible when stored in the database. That’s why his old password can be shown in the password notification email.
To have passwords irreversible is employing a one-way function or hash. To avoid the rainbow table attack, salts can be added when computing a hash.
AES256 doesn’t help in the case. It improves the security level by encrypting passwords, but it doesn’t solve the problem, the reversible passwords. When talking about encryption, we apply the Initialization Vector (IV) to increase complexity, instead of using the term salt. It implies a salted hash.
The “Forgot password?” button is a self-service to reset passwords and the web site is the portal for customers to reset passwords.
The delivery speed of password notification emails has nothing to do with the security concerns, reversible passwords.