2012-03-13, 01:15 PM
Another idea from SMF, with a bit more customization. This would allow a user to optionally set a security question for the purpose of password recovery. The administrator could pre-define security questions, as well as give users the option to define their own. Ideally, this modification would have three working modes.
1. Security Question & Email Validation required for PW reset.
You would be required to answer your security question in addition to the measure already in-place for password recovery. When you receive your reset email, if you had set a security question, you would be required to enter the answer before you'd be sent your new password.
2. Security Question OR Email Validation required for PW reset.
This would be similar to google's account recovery system. You would need to have not logged in for x number of days to be able to use the security question option to recover your account; then you would be able to set a new password.
3. Security Question & Email Validation Required for PW reset, Security Question required to unlock account.
Same as option one, but if your account gets locked for invalid password attempts, after waiting the allotted time, you would need to verify your security question after logging into your account before you could access anything else.
1. Security Question & Email Validation required for PW reset.
You would be required to answer your security question in addition to the measure already in-place for password recovery. When you receive your reset email, if you had set a security question, you would be required to enter the answer before you'd be sent your new password.
2. Security Question OR Email Validation required for PW reset.
This would be similar to google's account recovery system. You would need to have not logged in for x number of days to be able to use the security question option to recover your account; then you would be able to set a new password.
3. Security Question & Email Validation Required for PW reset, Security Question required to unlock account.
Same as option one, but if your account gets locked for invalid password attempts, after waiting the allotted time, you would need to verify your security question after logging into your account before you could access anything else.