So, I'm already sending random strings, but there's a few things that I know are just wrong and broken about my current thing, and I'm wondering what the approp

So, I'm already sending random strings, but there's a few things that I know are just wrong and broken about my current thing, and I'm wondering what the appropriate way to fix it is. 1. It doesn't limit how many tokens you try to send out; I'm not entirely convinced this is an issue yet, since these tokens are 256 bit, so you'd have to create quite a few before random attempts would start working... 2. The tokens do not expire. Again, I know both of these are wrong, but I'm not sure what the appropriate way to deal with them is. Limiting [1], i.e. the number of outstanding tokens, sounds like a bad idea, because then an attacker could lock the legitimate user out from being able to reset their password (barring a support call). Doing statistics on how many password reset requests are being made, per host and per credential, seems more efficient. Adding a simple 24h lockout to [2] seems like a good idea, and it happens to be ridiculously simple to implement, too :) Oh, by the way: tptacek, I sent you an e-mail weeks ago about a Pycon talk -- did you happen to get it perchance?