Hacker News new | ask | show | jobs
by yuhong 5033 days ago
The funny thing is that many sites does password reset via email anyway.
1 comments

Most passwords resets do not mail you the password; they usually mail you a unique URL which you can use to reset the password, which often generates a second mail telling you the password was changed.

That prevents anyone from "sneaking" into your account, even if the can snoop your mail / copy your inbox. You'll see the intrusion, and you'll be unable to log into the service after the password is changed.

Storing the password in plain-text in your inbox has none of that protection.