Support

UNiTE, Remote CLI, eXtract Wizard

#31545 – Login Guard SMS forgot password

Posted in ‘UNiTE, Remote CLI, eXtract Wizard’
This is a public ticket. Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.
Wednesday, 17 July 2019 17:04 CDT
Hi, is it possible to set up Login Guard for sending a "forgot password" SMS to the registered phone of the user instead of an email? Thanks.
Custom Fields
Which tool do you want support for? Login Guard
Tool version (in x.y.z format) general
 
bom
Thursday, 18 July 2019 00:54 CDT
No. This has nothing to do with what LoginGuard is supposed to do. I would also say that you will probably not find any extension that can do that because it's a bad, impractical and impossible to implement idea:
  • The email sending functionality for password resets is hardcoded in Joomla's com_users code. While a developer could conceivably write a plugin to also send an SMS message it would not be able to only send the SMS message instead of the email.
  • Joomla requires a 32 character long alphanumeric code for resetting passwords as a matter of security. It would be impractical to send it by SMS and ask the user to type it.
  • Overriding Joomla's password reset is conceivable with some trickery in some, but not all, circumstances. In this case a misguided developer could conceivably replace the reset token with a short lived, six digit code BUT this would make all accounts on the site susceptible to SIM swap attacks and plain old guessing (you'd have 2-10 minutes to guess the 6-digit code which is plenty of time). The reason this is not a massive issue for 2SV is that 2SV is used on top of a username and password not instead of.


So even if you could I would say that 100% you should absolutely and definitely NOT think about implementing such a feature. It would essentially replace all passwords with a 6-digit PIN which is trivial to hack. I understand what you had in mind but the law of unintended consequences applies very strongly to your idea. Sorry :(


Nicholas K. Dionysopoulos

Lead Developer and Director



Greek: native

English: excellent

French: basic



Please keep in mind my timezone and cultural differences when reading my replies. Thank you!



nicholas
Thursday, 18 July 2019 05:50 CDT
Thank you Nic. Your extensive and in depth explanation put a clear picture about the situation in my head. Again your expertise is priceless, thank you for your time!
 
bom
Thursday, 18 July 2019 06:04 CDT
No problem :) Have a great day!


Nicholas K. Dionysopoulos

Lead Developer and Director



Greek: native

English: excellent

French: basic



Please keep in mind my timezone and cultural differences when reading my replies. Thank you!



nicholas
Saturday, 17 August 2019 17:17 CDT
This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.
system
This ticket is closed, therefore read-only. You can no longer reply to it. If you need to provide more information, please open a new ticket and mention this ticket's number.

Support Information

Working hours: Typically we work Monday to Friday, 9am to 7pm Cyprus timezone (EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets, but we cannot respond to them, outside of our working hours.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!

Cookies Notification - Action required

This website uses cookies to provide user authentication and improve your user experience. Please indicate whether you consent to our site placing these cookies on your device. You can change your preference later, from the controls which will be made available to you at the bottom of every page of our site.