Basecamp isn't free, so they can likely devote a few more resources to a slightly more stringent password reset system than, say, icanhascheezburger.com. What

Basecamp isn't free, so they can likely devote a few more resources to a slightly more stringent password reset system than, say, icanhascheezburger.com. What I was trying to put forward for discussion is the idea that if a site can't do password resets "properly" (by phone? or something more secure than the example given in the article) then maybe it shouldn't do it at all, and that this might not be as catastrophic for the user as it seems, since the site is less likely to be essential. Looking at what I use online: - all my server stuff: Extremely important, but it's my own problem. - online banking, bills, etc: Important stuff, not free. I'd be really upset if I got permanently locked out, but all can be reset by phone. - Digg, Reddit, News.YC, even Facebook: Not important stuff, free. I wouldn't really care if I have to make another account. - Gmail: This is the only one which doesn't fit. However, I use it daily, so I'm not going to forget my password. On the flip side, if I used it only once a year, it obviously wouldn't be that important to me. Yeah, I know it's not very realistic, and it's probably not something I'm willing to practice myself. Consider it a thought experiment.