But wait, Healthcare.gov password reset is still insecure

So, while it appears that one of the password reset security holes at Healthcare.gov has been patched, there's still a problem with the design.

Do you see it? Is there a problem here?

The problem is that the system sends both the username and the reset code over email -- which is generally an insecure means of communication. For security purposes, these types of systems often send a password reset code without the username, and then require the user provide the username that goes with the reset code.  Sending both makes the system less secure.

Plus, there's one more problem that this image doesn't show: the password reset code stays the same. Each time I request a password reset for an account, I get the same code. This code should change. That it doesn't change suggests that, maybe, once a code is compromised, it can be repeatedly used again.

Certain information

I try to reset the password for a local Windows Server account and get the following warning dialog.



It warns that resetting the password might cause IRREVERSIBLE LOSS of "certain information". If the information that will be lost is certain, why doesn't this warning tell me what information will be lost and what won't be lost?

And what is this stuff about a disk? Who creates password reset disks for every user of a server? I haven't. Should I?

Wanting additional information, I click the Help button. This opens a local help document that explains what data will no longer be acceptable.  However, even this refers to "some types of information" and gives an "including" list. It doesn't give a full inclusive list. Or if this list is inclusive, that isn't clear from the help document.



If you are going to tell me that my actions might cause damage to "certain information", please have the courtesy to give me sufficient details to make an informed decision.