3 ms·

How is this any more of a problem than the conventional password reset email?

• marginalia_nu 5y ago
  If you try to reset your password too often, especially without logging in, you often end up with a "try again in 48 hours or contact support here", to prevent this type of attack. That doesn't really work if this is how you log into your account. The expected rate of these emails is much higher, so you can't be as restrictive in sending them out. Another difference is that the ramifications are much bigger. If your password reset doesn't work, the minuscule fraction of users that can't remember their password can't log in. In this scheme, none of your users can log in.