Ask HN: Strategy for password reset email vs URL to reset pwd

Post by clarkbox » Tue, Jul 19, 2011, 12:14 AM UTC

edanm wrote: post #22

trotsky wrote: post #15

You need to worry about users who have other people maliciously requesting resets just to bother them. A password reset link in email is the more easily ignored. If you send a new password, you need to make sure you still accept the old one in case it wasn't them who requested the reset. You'd also want/need to time out the 2nd "reset" password after a short period, as you don't want someone who gains access to their…

How common is the resetting someone's password to annoy them? I know it's a very common rationale for sending reset links, but I'm trying to remember if I've ever heard of it actually happening for real, and drawing a blank.

Post by drivebyacct2 » Tue, Jul 19, 2011, 7:59 PM UTC

kiritsinh wrote: post #29

drivebyacct2 wrote: post #11

The work it would take to make the specific generated password "one use" would be more effort than to send a reset password link. That shouldn't take any effort at all, really using any sort of tool/framework. One guy implemented it in like a half hour for our MVC3 app. I get irritated like none other with stuff like that. It's just like emailing me my password in plaintext. If the user doesn't change the password, t…

I agree on the fact that 'Generate temp password' will require more dev and user efforts but i don't think 'generate password' is more vulnerable than the link if the generated password is time bound. Also to make 'the link' more secure we need to verify the user identity. To make that happen need to store the user identity in the application.