ITPEC FE Morning October 2018 Question 41
A security question is used to authenticate a user who forgets his/her password for a web system. After the correct answer is given, which of the following is the most appropriate process in terms of security?
Explanation
Send a hard-to-guess reset URL to the pre-registered e-mail address — after the security question, the reset must go to a channel the real owner already controls, and no password is ever sent.
A security question is a weak factor on its own, since its answer can often be guessed or researched. The pre-registered address adds a second check: only the real owner reads that mailbox. A long, random, single-use URL with a short lifetime then lets the owner set a new password, so the old one never has to be retrievable or transmitted.
Answer (c)
Why not others:
- •(a) — an address typed in at reset time is whatever the requester chooses, so an attacker who guessed the security answer simply enters his own address and receives the link
- •(b) — combines both flaws: the address is chosen by the requester, and the current password is sent, which also means the system stores it in recoverable form instead of as a hash
- •(d) — the address is right, but mailing the current password exposes it in transit and in the mailbox, and a system that can send it is not storing it as a hash
Key rule: A safe password reset never reveals the old password; it sends a random, short-lived link only to contact details registered before the request.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.