> Plus there should be a pre-cooloff period after reset request is raised but before it is actually processed, and a post-cooloff periods for any additional fac

> Plus there should be a pre-cooloff period after reset request is raised but before it is actually processed, and a post-cooloff periods for any additional factor reseting, and regaining full privileges. That's, to me, the biggest one. It is quite a trivial idea, it's really not hard to add to any login process and yet very few this. But all hope is not lost for there are some sites that have seen the light and implement precisely that cool of.