News for hackers. Stuff that matters.
Re:But why can't I send people their passwords? by pmjordan on Wednesday June 25, 2014 @08:57AM (#7943586)
If someone hacks into your email account, they can just trawl through the email archive and harvest passwords from past password reminder emails. With a temporary reset token, they have to initiate a password reset request, which you should notice: (a) you might notice the email if you have e.g. push notifications enabled, or if the attacker doesn't delete it quickly enough, and (b) your real password will suddenly stop working.

Additionally, even if your reset request is harvested via MITM, if you use a single-use reset token, and an attacker uses it before you can, you know something is up. Even if it's not single-use, your password suddenly no longer working should ring alarm bells.

Re:But why can't I send people their passwords? by hackuser on Wednesday June 25, 2014 @12:36PM (#7945051)
And if someone hacks the system administrator's account, they may find everyone's passwords (for systems where the admin sets the pw and emails it).
Re:But why can't I send people their passwords? by bartwe on Wednesday June 25, 2014 @04:45PM (#7946663)
You're current password shouldn't stop working because otherwise that can be used as a denial of service without otherwise compromising the security of either the user or the site if the email address is known.
Re:But why can't I send people their passwords? by pmjordan on Thursday June 26, 2014 @06:34AM (#7948897)
Obviously it shouldn't stop working straight away, but presumably an attacker would actually use the password reset code, at which point they would set your password to something else, which you would notice.