3 ms·
No they don't have to. They can email users a link with an embedded hash that automatically logs them in. These links can expire. This is similar to how an emai
by quellhorst 16y ago
No they don't have to. They can email users a link with an embedded hash that automatically logs them in. These links can expire. This is similar to how an email password reset works.
- alexyim 16y agoBut the user could've still forgotten it though..
- deleted 16y ago[deleted]
- kencausey 16y agoThe system quellhorst describes does not require the user to know the password, or even their own username. They click the link in the email and they are automatically logged in; it's an alternate authentication scheme. If they have lost their password that's a separate issue that should be handled separately but similarly by emailing them a link, again with an 'embedded hash', that allows them to reset their password. The assumption of course is that they and only they can access the email address specified in their account profile. If that's not the case then this all becomes a bit more problematic.
- andrewvc 16y agoYeah, I agree it's unbelievable stupid. that was meant as a tongue in cheek statement, hence the 'yeah, I know' at the end. OKCupid used to use tokens fwiw.