6 ms·
Pros: You are able to send email updates to users. Cons: Duplicate users. Misdemeanor: Imagine if someone uses the whitehouse or fbi email addresses. Then he
by keiretsu 19y ago
Pros: You are able to send email updates to users.
Cons: Duplicate users.
Misdemeanor: Imagine if someone uses the whitehouse or fbi email addresses. Then he keeps on clicking on "Retrieve password" and you would start spamming the whitehouse and fbi.
- randallsquared 19y agoWell, this is an argument for requiring verification if you plan to use email for password resets. Alternatively, you can allow only a small number of password reset attempts per email address per day/hour/whatever. One thing that you shouldn't do is reset someone's password immediately when you send out the reset email. Instead, reset it only when they arrive back at the reset page, else you're opening a DOS attack for anyone whose email address is known.