[PATCH v2] auth: secure password reset implementation

[Mads Kiilerich]

On 08/08/2015 05:25 PM, Andrew Shadura wrote:
> # HG changeset patch
> # User Andrew Shadura <andrew at shadura.me>
> # Date 1431821238 -7200
> #      Sun May 17 02:07:18 2015 +0200
> # Node ID c4ad7e6deed43b0f725b60b37ae1d2161eead200
> # Parent  e84c2738fbd84569492c56e5a9361ee94af5d420
> auth: secure password reset implementation

A couple of other comments after more testing:

It still sends a 'Your new password' (with the crypted password) after 
setting it the new way. I guess it shouldn't.

When it gets to the 'set password for $email' page, the user has already 
kind of 'authenticated through mail'. We could/should thus greet the 
user with the full name and username so the user really know which 
account is being changed.

(Actually, I wonder if "authentication through mail link" could/should 
be one authentication method like anything else. That would be perhaps 
be elegant ... but a different story.)

Also, as hinted before, I don't like the hidden fields with email and 
timestamp. That makes it harder for the user to understand what is going 
on. Showing them (disabled input fields?) would give the (expert) user 
some important context.

/Mads