Hacker News new | ask | show | jobs
by StavrosK 5467 days ago
I disagree. All they did (edit: to clarify, it seems to me that they only tried two alternatives) was try sending a password reset link and the unencrypted password itself. I don't think sending the user a new password would be that big a deal (we're assuming they receive the email, as both methods will fail if not), and you could show them the password reset page immediately after they logged in with the new password.

Win/win.
1 comments
raganwald 5467 days ago
If the password reset function sends a temporary password just as you say, THEN it is not that big a deal. On the other hand, if they are storing every user's original password in such a way that they send the user their existing password...

I believe this is the scenario most people here think is happening.

link
StavrosK 5467 days ago
Oh, I'm sure it is. I'm saying that they should send a temporary password instead.
link