Password reset flows in No-Code - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of a password reset flow?

Consider a user who forgets their password. What is the main goal of a password reset flow in this situation?

A To display the user's old password for reference

B To allow the user to create a new password securely without revealing the old one

C To permanently delete the user's account

D To automatically log the user in without any verification

💡 Hint

Think about security and user convenience when they forget their password.

The password reset flow lets users set a new password safely, ensuring their account stays secure without exposing the old password.

📋 Factual

intermediate

Which step is essential in verifying a user's identity during a password reset?

When a user requests to reset their password, which of the following steps is crucial to confirm their identity?

A Allowing password reset without any verification

B Asking the user to enter their current password again

C Displaying the user's account details on the screen

D Sending a reset link to the user's registered email address

💡 Hint

Think about how services confirm that the person requesting the reset is the account owner.

Sending a reset link to the registered email ensures only the rightful owner can reset the password.

🔍 Analysis

advanced

What is the risk of not expiring password reset links?

Imagine a password reset link that never expires. What potential problem could this cause?

A The reset link would automatically update the password without user action

B The user would be forced to reset their password too often

C Someone could use an old link to reset the password without permission

D The reset link would not work on mobile devices

💡 Hint

Consider what happens if a link stays valid forever and falls into the wrong hands.

If reset links never expire, attackers who get hold of old links could reset passwords and access accounts without authorization.

❓ Comparison

advanced

Which method is more secure for password reset verification?

Compare these two verification methods for password reset: (1) Sending a reset code via SMS, (2) Asking security questions. Which is generally more secure and why?

A Sending a reset code via SMS is more secure because it requires access to the user's phone

B Asking security questions is more secure because answers are easy to remember

C Neither method provides any security

D Both methods are equally secure in all cases

💡 Hint

Think about how easy it is for someone else to guess or find answers to security questions versus accessing a phone.

SMS codes require physical access to the user's phone, making them harder to compromise than security questions, which can be guessed or found online.

❓ Reasoning

expert

Why should password reset flows avoid revealing whether an email is registered?

When a user enters an email to reset a password, why is it better not to confirm if the email exists in the system?

A To prevent attackers from discovering valid user emails through the reset form

B To make the reset process faster for all users

C To reduce the number of emails sent by the system

D To allow anyone to reset any account's password

💡 Hint

Think about how revealing account existence can help attackers gather information.

Not revealing if an email is registered protects user privacy and prevents attackers from collecting valid emails to target.

Practice

1. What is the main purpose of a password reset flow in an application?

easy

A. To change the username of the user

B. To delete the user account permanently

C. To help users regain access to their accounts safely

D. To update the user's email address

Solution

1. Step 1: Understand the purpose of password reset

   Password reset flows are designed to help users who forgot their password regain access to their accounts.

2. Step 2: Identify the correct purpose among options

   Only To help users regain access to their accounts safely describes this purpose correctly, while others describe unrelated actions.

3. Final Answer:

   To help users regain access to their accounts safely -> Option C

4. Quick Check:

   Password reset purpose = regain access [OK]

Hint: Password reset helps regain access, not change username [OK]

Common Mistakes:

• Confusing password reset with username change
• Thinking password reset deletes account
• Assuming password reset updates email

2. Which of the following is a common step in a password reset flow?

easy

A. Changing the user's username to 'reset_user'

B. Automatically changing the password without user input

C. Deleting the user account after reset request

D. Sending a reset link or code to the user's email

Solution

1. Step 1: Identify typical password reset steps

   Commonly, a reset link or code is sent to the user's registered email to verify identity.

2. Step 2: Compare options to standard practice

   Only Sending a reset link or code to the user's email matches this standard step; others describe incorrect or harmful actions.

3. Final Answer:

   Sending a reset link or code to the user's email -> Option D

4. Quick Check:

   Reset step = send link/code [OK]

Hint: Reset flows send links or codes, not auto-change passwords [OK]

Common Mistakes:

• Thinking password resets happen without user confirmation
• Believing accounts get deleted after reset
• Confusing username change with password reset

3. In a password reset flow, why is it important that the reset link expires after some time?

medium

A. To prevent unauthorized use if the link is intercepted

B. To allow users to reset password multiple times quickly

C. To make the reset process slower and more secure

D. To automatically change the password after expiration

Solution

1. Step 1: Understand security risks of reset links

   If a reset link never expires, someone who gets it later could misuse it to access the account.

2. Step 2: Identify why expiration helps security

   Expiration limits the time window for misuse, protecting the user's account.

3. Final Answer:

   To prevent unauthorized use if the link is intercepted -> Option A

4. Quick Check:

   Expiration = prevent misuse [OK]

Hint: Expiration stops old links from being misused [OK]

Common Mistakes:

• Thinking expiration slows down the process intentionally
• Believing expiration allows multiple resets quickly
• Assuming password changes automatically after expiration

4. A password reset flow sends a reset code to the user, but the code never expires. What is the main problem with this?

medium

A. The reset code can be reused by attackers anytime

B. Users might forget the code quickly

C. The system will send multiple codes automatically

D. The user cannot reset the password without expiration

Solution

1. Step 1: Analyze the effect of no expiration on reset codes

   If reset codes never expire, anyone who obtains the code can use it anytime to reset the password.

2. Step 2: Identify the security risk

   This creates a security risk because attackers can reuse old codes to access accounts.

3. Final Answer:

   The reset code can be reused by attackers anytime -> Option A

4. Quick Check:

   No expiration = code reuse risk [OK]

Hint: No expiration means codes can be reused by attackers [OK]

Common Mistakes:

• Thinking users forget codes quickly is the main issue
• Assuming system sends codes automatically without request
• Believing expiration prevents password reset entirely

5. You want to design a password reset flow that prevents attackers from guessing reset codes easily. Which approach is best?

hard

A. Use short numeric codes that expire quickly

B. Use long random alphanumeric codes with expiration

C. Send the reset code via public chat for transparency

D. Allow unlimited attempts to enter the reset code

Solution

1. Step 1: Consider code complexity and expiration

   Long random alphanumeric codes are harder to guess than short numeric ones, and expiration limits time for attacks.

2. Step 2: Evaluate options for security

   The approach of using long random alphanumeric codes with expiration combines strong code complexity with time-limited validity, providing optimal security. Other approaches--short numeric codes, unlimited entry attempts, and public code sharing--are vulnerable to guessing, brute-force attacks, or interception.

3. Final Answer:

   Use long random alphanumeric codes with expiration -> Option B

4. Quick Check:

   Strong code + expiration = best security [OK]

Hint: Long random codes with expiration improve security best [OK]

Common Mistakes:

• Choosing short codes that are easy to guess
• Sharing codes publicly reduces security
• Allowing unlimited attempts invites brute force