A lot of websites, like for example, webmail clients, require a secret phrase or security questions to reset your password, to guarantee it's really you. Would this be a good idea to implement into MyBB by default? Currently, all you need access to is someone's email to reset their password, which could easily be compromised, or accessed if you share a computer with someone.
Thoughts?
(2012-11-25, 02:38 AM)pandaa Wrote: [ -> ]A lot of websites, like for example, webmail clients, require a secret phrase or security questions to reset your password, to guarantee it's really you. Would this be a good idea to implement into MyBB by default? Currently, all you need access to is someone's email to reset their password, which could easily be compromised, or accessed if you share a computer with someone.
Thoughts?
I am not sure, i guess it would be a okay / good idea but it might as well be a plugin. The biggest problem i guess i have with security questions is nobody ever seems to remember them. And you dont see them very often outside of mail clients and certain games.
If its a switch sure then again i think they already stopped taking in request for new features (for 1.8). Nathan said it quite a few times.
How about if the reset password feature sends a mail with an activation link first and only if you follow that link it actually resets your password. That way, if some funny guy resets your password, all you get is activation link spam.
This would be a brilliant idea, especially for websites who combine their forums to their main sites and share the same DB. I would love this function to be introduced into the next version of MyBB.
The activation thing is already in there
but the OP is concerned about the attacker already having access to your email account. I missed that bit the first time I read it, sorry... sounds like a plugin request then, I guess.