I've yet to receive an email so I just went to their site. Upon logging in with my (presumably) exposed password, I was given the option to enter a new passwor

I've yet to receive an email so I just went to their site. Upon logging in with my (presumably) exposed password, I was given the option to enter a new password immediately. Their password reset should fire off an email instantly, not using a batch delivery process, with a confirmation link that then logs me into their system with a one-time key, forcing me to change my password only then. Yes, that is marginally more complicated, but it's miles more secure. They just gave a free password reset form to whoever is sitting on their database dump for any trivial dictionary passwords they're able to bruteforce. Not doing a mass password reset would have had the same effect. FWIW, I've also yet to receive any confirmation email that my password has been reset, another potential security problem.