yeah, that one is hard to live down. It's happened (as far as we can tell) twice in the entire history of the company, amongst hundreds of "I've lost my passwo

yeah, that one is hard to live down. It's happened (as far as we can tell) twice in the entire history of the company, amongst hundreds of "I've lost my password" requests per week. Lost password was seriously in the top three most common support requests every week right up until we built the automatic recovery system: https://blog.fastmail.com/2016/07/21/multiple-ways-in-keeping-password-reset-secure/ https://blog.fastmail.com/2016/07/21/multiple-ways-in-keepin... and we responded fairly directly to that Hacker News thread the next day with this: https://blog.fastmail.com/2017/12/06/security-account-recovery/ https://blog.fastmail.com/2017/12/06/security-account-recove... Obviously it's hugely embarassing to the company that it happened at all, and awful for the victim. I think it's perfectly reasonable for you to bring it up, and it is a consideration for anybody choosing us to do their research and decide if the steps we've taken to mitigate it happening again are sufficient.