> I guess I am being insufficiently clear about why this is no less secure than what exists today. Because it sounds scary really. But if someone aiming to tak

> I guess I am being insufficiently clear about why this is no less secure than what exists today. Because it sounds scary really. But if someone aiming to take over an account already has access to the account's email inbox then forcing the user to reset their password immediately is no hurdle, it inconveniences a legitimate user (however briefly) more than a malicious user. However, I am still not in favour of an immediate auto-login without a password reset beforehand (as there is a need for the user to update their password). Since we've already 'verified' that the user at least has access to their email (so it is probably them) I don't see anything wrong with automatically authenticating the user after this though.