Password reset tokens are single-use. If the resets are time- and IP- limited then attacking them is awkward (reset a password while the victim's in the same ro

Password reset tokens are single-use. If the resets are time- and IP- limited then attacking them is awkward (reset a password while the victim's in the same room?) I don't think "nearly all" is right. I've never worked on a site which mailed out plaintext passwords; and I can't think of a site I regularly use (other than HN) that does it. However, I tend to close accounts if sites mail me plaintext passwords - so my sample's a bit self-selecting.