Ask HN: Strategy for password reset email vs URL to reset pwd

Re:Ask HN: Strategy for password reset email vs URL to reset... by gojomo on Sunday July 17, 2011 @09:42PM (#2774792)

If you just send a new password, the user may not change it. (They may count on the browser to remember it, or figure they'll just refer to the email again in the future.)

As a result, any future brief read-only compromise of their mailbox revealing that password may grant unauthorized access to their account.

Sending a time-limited link forces the choice of a new password. They might choose unwisely, but it would take an active compromise of their mailbox (intercepting a future reset-request) to leverage a password-reset to future compromise. If they do choose a bad password, that could be as bad as having your password sitting in their mailbox.

[ Parent | on HN ]

Re:Ask HN: Strategy for password reset email vs URL to reset... by ayers on Monday July 18, 2011 @04:14AM (#2775517)

I can second that people will rely on the browser to remember the new password or copy/paste the password and then refer to that email when they need it again. I do this myself sometimes for some sites that I do not use regularly. Like many others have suggested I think a link to a form to create a new password would be better than emailing out a temporary new password.

[ Parent | on HN ]