"Just Reset the Password" Is Not a Security Strategy
A weak self-service reset flow, no MFA, and a shared or reused password add up to one thing: a door anyone can walk through if they ask the right question.
Written by Shimon Goldner
Someone forgets a password, and the fix is almost always the same: reset it, hand over a new one, move on. It feels like a solved problem. It isn't, it's a workaround that quietly assumes the person asking for the reset is who they say they are, every single time.
Where it actually breaks down
Self-service reset flows built around a security question or a personal email are easier to get around than most people assume, a lot of that "secret" information isn't secret at all anymore. A helpdesk that resets a password over the phone based on a name and a request is trusting a voice, not a person. And if that account doesn't have multi-factor authentication turned on, the new password is the only thing standing between an attacker and everything in that inbox.
Layer on the habit of reusing the same password across a work account and a dozen personal ones, and a breach at some completely unrelated website can hand someone the keys to your business email without them ever touching your network directly.
A helpdesk that resets a password over the phone based on a name and a request is trusting a voice, not a person.
What actually holds up
MFA on every account, no exceptions, closes off the single biggest gap, a stolen or guessed password alone stops being enough to get in. A real identity verification step before any reset, not just a name and a claim, keeps the reset process from becoming the weak link itself. And strong, unique passwords, ideally generated rather than remembered, remove the reused-password problem entirely.
If your team is picking their own passwords out of habit, our free password and passphrase generator is a quick way to start building better ones.
Where passwords should actually live
Memorizing passwords, keeping them on a sticky note, or storing them in a shared spreadsheet all have the same problem: no real access control, no audit trail, and nothing stopping people from reusing the same weak password everywhere. A real password manager, 1Password, Keeper, and Bitwarden are common choices, fixes that by generating a unique password for every login and letting you control who on the team can actually see what. If your business already runs on Microsoft 365 or Google Workspace, both platforms also have built-in credential and password management features worth turning on before you go looking for a separate tool.
Resetting a password when someone forgets it is a support task. Making sure the right person is on the other end of that request is a security task, and it's the one that actually matters.