|Scenario Task Description=Password are easily forgotten (unless you are using a [https://securityinabox.org/en/guide/keepass/windows password program] and the ). This is why most service provider offers providers offer several opportunities for you to reset this your password by sending you an email or by asking you a personal question of your choice to prove your identity. Whilst often necessary, both options may result in a security risk and need to be thought through carefully in advance. Please For an excellent description of the problem, you can read this [http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ Wired article from by Matt Honan] for an excellent description of the problem.

# Resetting a password by sending the code to another email account opens up another attack vector for the hacker. If they can break into one account and then request the reset password to another account to be sent there, you are worse off than before.# Setting a security question based on personal information (e.g. your mother's maiden name) means the attacker only need needs to find out this information now in order to reset your account password and gain accessto your account.

If at all possible, it is best to not set any reset options. If you want this option or are required to do so, put yourself in the hacker's shoes and make sure their task wont won't be easy.