Ask HN: Strategy for password reset email vs URL to reset pwd

Re:Ask HN: Strategy for password reset email vs URL to reset... by carbocation on Sunday July 17, 2011 @09:15PM (#2774728)

1) I like the single-use token, but I'm interested in hearing others' perspectives.

2) Don't just hash. Use bcrypt, since it's probably got a library for you to use in your language (or database) of choice: http://codahale.com/how-to-safely-store-a-password/

[ Parent | on HN ]

Re:Ask HN: Strategy for password reset email vs URL to reset... by retrofit_brain on Sunday July 17, 2011 @09:19PM (#2774735)

We do use BCrypt. Trying to figure out if implementing an extra layer of sending an email with a link to reset password has advantages over just sending a one time changed password.

[ Parent | on HN ]

Re:Ask HN: Strategy for password reset email vs URL to reset... by aurelianito on Sunday July 17, 2011 @10:37PM (#2774902)

It is easier on the user.

Why don't you just send a link that includes your one time password? This will allow the user to choose a new one just clicking on the link and setting the new password, instead of going to your page, logging in and changing the password after that.

[ Parent | on HN ]