Weak Password Recovery Validation

A UK Security Consulting firm reports that 54 UK sites that it has surveyed have flaws in the "forgotten password" feature.

Additional information:

• Forgotten password clues create hacker risk [The Register, Mar 20 2006]

Details remain sketchy, but news reports include social engineering, a guessable secret question for password recovery, and a known vulnerability is BEA WebLogic

Additional information:

Additional information:

• Microsoft faces huge fine over security [Zdnet, May 9 2003]
• Microsoft Patches .NET Passport Hole [AnyNetwork, May 8 2003]

Weak password recovery procedure at Citrix

Additional information:

• Example of the worst passwd recovery interface [WebAppSec mailing list, Aug 3 2005]