3 ms·
That puts the onus on the user to immediately log in after receiving the temporary password. Until they do (which could be months later), they have their passw
by Deregibus 14y ago
That puts the onus on the user to immediately log in after receiving the temporary password. Until they do (which could be months later), they have their password to the site stored in email. The DoS issue that was mentioned in the next paragraph is also a pretty good reason to use a reset link instead.
- stephenr 14y agoSo you're suggesting that a user who goes to a site to login, and can't (forgotten password) will then completely lose any and all reason to login to the site, AFTER doing what's required for a new random password to be generated and sent to them? Sounds pretty far fetched to me.