Question: I don't know how to write this without it sounding like a plug (lol), but it's not. So please don't close-vote it, even if you really want your editor badge. Here goes:

There's this site called av-comparatives that I use and trust to provide me independent antivirus reviews. You probably do, too, actually. While I keep myself somewhat knowledgeable about infosec, my specialties lay elsewhere and it's so useful for me to have something like that as a resource.

I don't know of anything like that for firewalls, and when I go out to find one, I'm accosted with millions, all claiming that one product or another is the best. Cross-referencing them often leads to one or two that I've never heard of. The (I think) fairly obvious conclusion there is that these are all just fake third party review sites set up for marketing purposes.

Unfortunately, I don't have the resilience to wade through such murky waters for so many more hours :P

> 
> IMPORTANT: This is **NOT** an open invitation to fake firewall review sites to post
>  their crap. I will respond appropriately to spam. 
> 
> 
> 

I'm looking for legit review sites that you, as security professionals, trust (ie: on par with av-comparatives, which you probably trust too)

Answer: 
Possibly. It's not immediately clear if you are relying on the email address as the sole identifier (i.e. you're using it as the username) or if a separate username is in play. If the latter case, then the obvious flaw is that an attacker can supply the username of someone else, but provide their own email address as the destination for the recovery password.

Assuming the email address is the only identifier for a user, obviously it will need to be supplied by them in order to reset their password. I would suggest that regardless of whether an account associated with that email address actually exists, the system should respond similarly. (E.g. saying "Your password recovery information has been sent.") However, you would obviously only want to send the recovery email if there is a corresponding account; if no such account exists there is nothing to recover. This prevents an attacker from trying multiple addresses to see which succeed and which fail, and thus building a list of valid accounts on the system. (If your application is faster to respond if it doesn't need to send the email, you may wish to intentionally add a random bit of time delay to hide that.)
There are some potential significant issues, mostly related to aspects of your procedure that have not been specified (hence "potential"). These are additional considerations, rather than problems with your method:

* **Automated bots might spam users by submitting lots of different email addresses.** Emailing (or at least giving the same form response), regardless of whether a user is valid or not, is a good way of preventing username enumeration, but it does open you up to this risk. Consider using a CAPTCHA when users are requesting the reset email, to prevent automatic submission.
* **The secret value embedded in the link might be too easy to guess.** If the token included in the link is not randomly generated with a high level of entropy, an attacker might be able to guess it.
* **The secret value could be re-used by an attacker if the email is compromised at a later date.** The token should be single-use (i.e. a nonce), and ideally expire after a set amount of time (appropriate for your user base and security requirement - [OWASP recommend as little as 20 minutes here](https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet#Step_3.29_Send_a_Token_Over_a_Side-Channel), but you may consider your application to not be that sensitive).
* **The secret value could be intercepted.** Email lacks end-to-end encryption, and you do not know how secure a user's endpoint or mail servers are. Some applications therefore require additional verification steps before or after sending and following the link. [OWASP recommend secret questions](https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet#Step_3.29_Send_a_Token_Over_a_Side-Channel) in *addition* to the email, although you may feel that this is excessive for the sensitivity of your application.
* **The new password is not submitted with transport security.** Naturally the URL in your email should point to an HTTPS page (partially so the user can verify that they are submitting their new password directly to the server), and then the form should submit the password over HTTPS as well.
* **An attacker requests a reset email on a user's behalf, and the user is unable to prevent the token from remaining active.** Consider providing a way for users to cancel the password reset from the email, enabling them to deactivate the link if they did not request it.
* **The user is not notified if an attacker succeeds in changing their password.** Consider at least notifying the user via email of every successful password reset, in case it was not initiated by them.