So another implementation problem is weak password recovery or reset solutions, so let's say that you
want to change your password.
So here you should have a look to see if the current password is confirmed or not.
And as a password change form akin to CSR tech, which we are going to cover and the session management
section.
But the other thing is, well, that can happen, all of us, we all forget the password, right?
I do.
Sometimes.
Now, what information is required to recover the password, so here come the secret security questions
and maybe second communication channels that proves the real user.
And again, the application should confirm the Rickover request on a second channel.
So going to Cali and logging to be Web.
From the drop down menu, open forgotten function under broken authentication.
So I'm logged in as a user bee and the level is low.
Now, what I expect to see here is to learn my secret or password, because I don't remember.
So the application wait for my email address, but there's a problem.
What if I don't know my email address?
So I'm going to check from my P my admin interface user's table.
Browser users.
OK, so this is my email and I'm going to write it into the input field and click Forgot.
Then it immediately prints it to the page.
OK, so you see that this is a bad implementation because it obviously holds the secret or maybe even
the password in clear text.
Not good, but you know something, you know what's really bad is when you write the email address of
another user.
And you get the USA's secret, so if you know the e-mail of any user, you can learn their secret.
Uh, is this terrible implementation?
So now let's change the level of medium.
OK, so I'm going to enter my users email address.
And this time it sends the secret to my email.
OK, so open up a new tab and go to mail and order dot com.
So this application provides disposable e-mail boxes, you don't even need to create a real account,
so just type the BWB into the open inbox for this user.
And the first one is the latest message that's come up.
So click it.
And what do you know, here's the secret.
And it's still in clear text.
So why don't we try other email addresses, be Web user one and be Web user to go to mailing later again?
Over the inbox for BWB user one.
Here's a secret.
And over the inbox for Bapu's user two, you've got mail.
So this is really good to send each secret to the real person, but the sensitive information is in
clear text.
OK, so let's go back and open, Brad.
Change the level of high.
So now I'm going to enter my e-mail address, and this time I will send a reset code.
Open mail, Nader.
Go to inbox.
Here is the latest mail.
So as you can see, this time, there is a link attached with a reset code.
But now go to my admin, refresh the page.
The reset code is stored in the user's table in the corresponding user column.
OK, so now click the link in the mail.
And it will send us to a changed form.
And then we can change the secret.
So for this kind of option, of course, yes, the mechanism works well.
But for instance, there's no time for the reset code, right?
Also, the reset forum is not protected against brute force attacks.
There's no capture protection.
OK, so open up your terminal now, display the page, B.A. underscore forgotten that BHP.
And it takes an email from the user.
Then after validation, it queries the user table with us email.
And if the security level is low, it just prints the secret.
It's levels medium, it sends a secret in clear text to the user.
And then on this line, when the level is high, it creates a random string.
And that is the reset code for the end user.
It creates a link containing the reset code.
Then it sends it to the user.
All right, so in this lesson, we analyze some really bad implementations of password forgotten functions.
Now, of course, in the real world, you will face some others, you will face those go to.
But I think you get the point right and you know where and how to look.