If HN replaces your password with a random one when requesting a forgot password, that's a great way to denial of service someone -- just keep requesting new pa

If HN replaces your password with a random one when requesting a forgot password, that's a great way to denial of service someone -- just keep requesting new passwords every 10 seconds and they'll never be able to login. The better approach is to generate a secure password change link with an expiring change request token. Upon clicking the link, the token is validated and you're allowed to set a new password (or have one randomly generated). However, until the link is clicked and the token validated your old password should remain the same.