3 ms·
There's a difference between those two features. Changing the password requires entering the old password and entering the new password, so you're authenticatin
by nick_lewis 15y ago
There's a difference between those two features. Changing the password requires entering the old password and entering the new password, so you're authenticating them via their password. Resetting the password requires sending a link to an email account you know they own, so you're authenticating them via their email account.
It's SORT of a "thing you know" vs. "thing you have", except the email account is kind of also a thing you know.
- sneak 15y agoThey both change the password, thereby granting access to the account. The security issue is really just the true stupidity of "sending password reset links via unencrypted email" - but it's already the standard so we can leverage that to offer auto-login links at no extra charge.