4 ms·
It can get way worse than that: at a big chess site I used to play at, a password reset email gives you a url of the form ".../passwordreset.php?user=yourname&p
by epaga 14y ago
It can get way worse than that: at a big chess site I used to play at, a password reset email gives you a url of the form ".../passwordreset.php?user=yourname&password=yourfreakingpasswordincleartext" I let them know about it years ago. Nothing changed.
- larrybolt 14y agoEven more scary if the link isn't over ssl, but even than third party services could make it risky. http://stackoverflow.com/questions/893959/if-you-use-https-will-your-url-params-will-be-safe-from-sniffing http://stackoverflow.com/questions/893959/if-you-use-https-w...