Passwords and account recovery
Many password rules that look strict are now discouraged, and account recovery remains a favorite way in for attackers. This lesson helps you align your policy with NIST and CNIL guidance, and specify a forgotten password journey that protects your users instead of exposing them.
Lesson objective
By the end of this lesson, you will be able to write password rules that comply with current recommendations (NIST SP 800-63B-4 and the CNIL, France's data protection authority), specify a forgotten-password journey that does not reveal which accounts exist, and spot the flaws in account recovery journeys.
Topics covered
- password policy
- NIST 800-63B
- CNIL guidelines
- forgot password flow
- account recovery
Where it fits
Knowing who signs in
How do you verify users' identity, keep their session and give them access back without opening a security hole?
Lessons in this module
- Authentication, authorization and sessions
- Passwords and account recovery (this lesson)
- Two-factor authentication and passkeys
What you will learn in this module
This lesson is part of the course Design authentication and permissions for a product
- Distinguish authentication, authorization and session, and specify session durations, sign-out and access revocation.
- Specify password rules and account recovery journeys following current recommendations (NIST SP 800-63B-4, CNIL, OWASP).
- Choose strong authentication factors (TOTP app, passkeys), plan their rollout and specify the fallback journeys.
Related courses
- Product ManagementAdvancedRegular practice: you already use the tools or work on this topic.
Git for PMs: ship as a team without putting production at risk
3 hr 30 min
- Tech for PMsAll levelsNo prerequisites: accessible to everyone.
Explain how a web product works, from browser to server
2 hr 30 min
- Tech for PMsJuniorSome basics are useful: introductory knowledge of the topic.
Design and test an API integration as a PM
3 hr