Re:But why can't I send people their passwords?
by hackuser on Wednesday June 25, 2014 @12:36PM
(#7945051)
And if someone hacks the system administrator's account, they may find everyone's passwords (for systems where the admin sets the pw and emails it).
Re:But why can't I send people their passwords?
by bartwe on Wednesday June 25, 2014 @04:45PM
(#7946663)
You're current password shouldn't stop working because otherwise that can be used as a denial of service without otherwise compromising the security of either the user or the site if the email address is known.
Re:But why can't I send people their passwords?
by pmjordan on Thursday June 26, 2014 @06:34AM
(#7948897)
Obviously it shouldn't stop working straight away, but presumably an attacker would actually use the password reset code, at which point they would set your password to something else, which you would notice.
Additionally, even if your reset request is harvested via MITM, if you use a single-use reset token, and an attacker uses it before you can, you know something is up. Even if it's not single-use, your password suddenly no longer working should ring alarm bells.