‫So another implementation problem is weak password recovery or reset solutions, so let's say that you
‫want to change your password.
‫So here you should have a look to see if the current password is confirmed or not.
‫And as a password change form akin to CSR tech, which we are going to cover and the session management
‫section.
‫But the other thing is, well, that can happen, all of us, we all forget the password, right?
‫I do.
‫Sometimes.
‫Now, what information is required to recover the password, so here come the secret security questions
‫and maybe second communication channels that proves the real user.
‫And again, the application should confirm the Rickover request on a second channel.
‫So going to Cali and logging to be Web.
‫From the drop down menu, open forgotten function under broken authentication.
‫So I'm logged in as a user bee and the level is low.
‫Now, what I expect to see here is to learn my secret or password, because I don't remember.
‫So the application wait for my email address, but there's a problem.
‫What if I don't know my email address?
‫So I'm going to check from my P my admin interface user's table.
‫Browser users.
‫OK, so this is my email and I'm going to write it into the input field and click Forgot.
‫Then it immediately prints it to the page.
‫OK, so you see that this is a bad implementation because it obviously holds the secret or maybe even
‫the password in clear text.
‫Not good, but you know something, you know what's really bad is when you write the email address of
‫another user.
‫And you get the USA's secret, so if you know the e-mail of any user, you can learn their secret.
‫Uh, is this terrible implementation?
‫So now let's change the level of medium.
‫OK, so I'm going to enter my users email address.
‫And this time it sends the secret to my email.
‫OK, so open up a new tab and go to mail and order dot com.
‫So this application provides disposable e-mail boxes, you don't even need to create a real account,
‫so just type the BWB into the open inbox for this user.
‫And the first one is the latest message that's come up.
‫So click it.
‫And what do you know, here's the secret.
‫And it's still in clear text.
‫So why don't we try other email addresses, be Web user one and be Web user to go to mailing later again?
‫Over the inbox for BWB user one.
‫Here's a secret.
‫And over the inbox for Bapu's user two, you've got mail.
‫So this is really good to send each secret to the real person, but the sensitive information is in
‫clear text.
‫OK, so let's go back and open, Brad.
‫Change the level of high.
‫So now I'm going to enter my e-mail address, and this time I will send a reset code.
‫Open mail, Nader.
‫Go to inbox.
‫Here is the latest mail.
‫So as you can see, this time, there is a link attached with a reset code.
‫But now go to my admin, refresh the page.
‫The reset code is stored in the user's table in the corresponding user column.
‫OK, so now click the link in the mail.
‫And it will send us to a changed form.
‫And then we can change the secret.
‫So for this kind of option, of course, yes, the mechanism works well.
‫But for instance, there's no time for the reset code, right?
‫Also, the reset forum is not protected against brute force attacks.
‫There's no capture protection.
‫OK, so open up your terminal now, display the page, B.A. underscore forgotten that BHP.
‫And it takes an email from the user.
‫Then after validation, it queries the user table with us email.
‫And if the security level is low, it just prints the secret.
‫It's levels medium, it sends a secret in clear text to the user.
‫And then on this line, when the level is high, it creates a random string.
‫And that is the reset code for the end user.
‫It creates a link containing the reset code.
‫Then it sends it to the user.
‫All right, so in this lesson, we analyze some really bad implementations of password forgotten functions.
‫Now, of course, in the real world, you will face some others, you will face those go to.
‫But I think you get the point right and you know where and how to look.