My primary goal for this weekend is to implement the best way to deal with password resets. With the help of users in the forums, before tomorrow night I want to come up with a way that is easier for the customer, more secure, and which continues to reduce customer support requests from Chris.
The current password reset procedure is for users to E-Mail Chris with a signed message, or to send Chris money, from an address associated with the account. This method is no longer workable because it costs almost $8 for a proof transaction if done with bitcoins. Additionally, we've found that criminals are targeting customers who reuse passwords. Theoretically, they could change their payout addresses, after which they can sign a message from the changed payout address to defeat the system and get a password reset.
I've come up with a few ideas, and hope that others will come up with more so that we can choose one to implement before tomorrow night.
- We could simply change the policy to state that no password resets will ever be accepted, and people who lose access to their passwords will receive payouts when accounts are purged after 90 days. This may turn out to be the best policy. The major downside, of course, is the loss of statistics in these accounts which would be permanently inactive, and anger from customers who won't be helped. The upside is that there is no personally identifiable information required to enforce this policy, and little or no money is lost because the payouts would just go to the addresses in the lost account.
- We could enable users to enter their E-Mail addresses, where password reset messages can be sent. When requested, the user clicks on a link to reset the password from an E-Mail. I think this method actually reduces security by adding a vulnerability of securing access to an E-Mail account.
- We could create a policy where the user has to identify something unique about the account to get a password reset that is not available to the public, like the names of all the workers which have connected to the account in the past day. Other private statistics, like electricity cost, could also be used. We could even automate the signed message process in this way if it is determined that is secure enough.
We could also combine the third with an optional E-Mail notification, so that if a reset occurs, the account owner gets an E-Mail. I suspect, however, that most people would not enter their E-Mail addresses, and therefore would not take advantage of these E-Mails.
Please offer your thoughts on how we can improve the password reset procedure so that I can implement the changes this weekend.
