Earlier quoted context omitted.
I guess here Evernote figured any instructions they sent would have resulted in a link being sent anyway, so why not just send the link and ensure a higher shot off compliance. They seemed to have forgotten about phishing. Some sites have taken to including in such emails account information that presumably only the company would know (such as part of the account number) along with the name. I know of at least one ba…
Not to mention that most email has roughly the same security level as a postcard. There are a lot of personal details that I wouldn't want written on a postcard. Not to mention the fact that lots of 'personal information' is not in fact private, e.g. date of birth (one of my financial accounts uses date of birth), mothers maiden name, social security number, etc.
Re: How not to send password reset notification email
#41True that. I often think of how many services ask for the same info as "security questions". By definition, if there's a "standard" set of such questions, it's not secure.