1

I am working in a project where there are two procedure to change user password :

  1. The more common technique, in which user click on "change password" button (or "forgot password"). Then user has to insert it's login and new password. Procedure will check if the login match to an actual user and if so send to him a confirmation email (with a confirmation link)..

  2. Admin users are allowed to reset password of any user, if so the password is reset to default (no mail and no confirmation, same default value for every user)

I am concerned about GDPR compilance of this second method, because potentially admin can reset a target user password, and then snoop into the account. From my understanding a GDPR compliant application have to prevent data leakage to technicians

6
  • Do note that the "default" usually is a one time password. Also, in general, it is typical to have random characters in those passwords, though it often is easier to handle them with things like temp1234 or something similar. However, if a Sysadmin uses such methods to snoop (investigate), that is very readily noticeable by the user as their known password doesn't work anymore.
    – Trish
    Aug 29, 2022 at 13:25
  • @Trish you are right, it's noticeable, but my scenario does not use one time password (for every user). For example, after reset, the password is "default_password" (and is known by convention among parties, no information into email) for every account resetted. User celarly can then change password to what he prefer. Is this scenario acceppted by GDPR?
    – Skary
    Aug 29, 2022 at 14:17
  • That actually depends on how you and the password resetter are related: if you are an employee and it is your workstation-password, GDPR doesn't actually apply.
    – Trish
    Aug 29, 2022 at 14:28
  • @Trish GDPR does apply in an employment context. Art 88 GDPR only provides an opening clause for other laws and for collective agreements to override the GDPR with more specific rules, subject to the limitations in that article.
    – amon
    Aug 29, 2022 at 15:02
  • 1
    Having admin users reset passwords to a known default password creates a lot of other legal/security issues. Can be hard to say who did something if the password can be reset to a known value and anyone with that access can log into any account.
    – Joe W
    Aug 29, 2022 at 19:39

2 Answers 2

6

The GDPR does not provide specific rules about password resets. However, the GDPR contains a general obligation for the data controller to implement “appropriate technical and organisational measures” (TOMs), see Art 24 + 32 GDPR. What is appropriate depends on the “state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity”.

A password reset functionality is complicated from a security perspective. On one hand, such functionality is really good because it ensures availability of the service for the user. On the other hand, such features can provide a backdoor to the service, undermining security goals such as confidentiality and integrity. These aspects must be balanced, and there is not necessarily one correct balance for every scenario. What the one-person IT department of a small company does can reasonably be different from what a multi-million user social network does.

TOMs do not have to be purely technical – they can also include organisational aspects, for example training for customer service employees, and occasional checks to ensure that customer service staff doesn't abuse their access.

But nevertheless, TOMs must be measured against the state of the art.

  • Password reset by sending a time-limited one-time reset link with a cryptographically secure nonce to an email address is a state of the art method, assuming that no 2FA/MFA is involved.
  • In some contexts, having customer service staff assign a new, random, one-time password could also be appropriate, for example if implementing a more secure workflow would be prohibitively expensive. Then, organizational measures would be more important.
  • Failing to notify the account holder that someone requested a password reset is not state of the art, and represents a possible security risk. The data controller is required to defend against such risks!
  • Resetting the password to a fixed default value is a very grave security risk, since it could aid unauthorized account takeover by a third party. It is unlikely that such a password reset approach could be GDPR-compliant.
1

GDPR does not actually enter into the technical details of how data is secured.

If it comes to that, the regulatory agency (or the judge if you challenge its decission) will decide if you have been negligent in handling your data.

Here, I guess it will matter a lot of other things, like:

  • Which kind (and value) of information are you protecting.
  • Which is the actual procedure (if the user must physically go to the admin desk, show his ID, and the he is given a terminal to change immediately the password it would not be the same that if it were just a "Forgot my password" link).
  • ...

And in any case it depends of what data you are securing, if it is not Personal Identifiable Information GDPR does not apply at all.

1
  • The password secure a B2B platform. So information provided are not "critical" (the platform only collect data that are then validated by operators during "finalization" pahse) but data submitted definetly are sensitive. So i guess this solution (the password reset to fixed value) is not viable
    – Skary
    Aug 30, 2022 at 8:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .