3 ms·
I don't think it's a good idea to make a password reset take 3 entire days. In this case, I'd say the costs outweigh the benefits.
by NieDzejkob 6y ago
I don't think it's a good idea to make a password reset take 3 entire days. In this case, I'd say the costs outweigh the benefits.
- curiousllama 6y agoYea, 10 minutes & a text message would suffice, IMO...
- LeifCarrotson 6y agoI think the most important part would be to give someone time to vet that it's legitimate. Stack Exchange has on the order of 100 developers, it wouldn't be hard to CC account creation or password reset notices to the manager of a new hire, and in that case, 10 minutes would often be enough to say "Uh, I haven't hired anyone named Curious Llama, who are they and why are they requesting developer access to an obsolete resource?" and put the brakes on.
- Hjfrf 6y agoThat might not have helped in this case, if the email was sent from the same account. The hacker had access to messages from the sender side without access to the account being reset.