4 ms·

But the mail is stored!

• ptaipale 10y ago
  Fortunately, the mail is not typically stored in the user database, so acquiring it would take at least a separate leak.
• unlinker 10y ago
  By you, right? Or is it common practice to store outgoing mails?
  • jonathankoren 10y ago
    You could always not store password reset emails.
• Bartweiss 10y ago
  Arguably, sending a one-time password over email in plaintext isn't a disaster. It's stored, fine, but it's no less secure than the user's email account (that you were going to reset to anyway). If internal storage on the site is still responsible, it's not a huge concern. Of course, a truly healthy system also wouldn't allow email-only resets, but that's life.