I would think that Troy alludes to his very extensive piece detailing how and how not to do password resets. http://www.troyhunt.com/2012/05/everything-you-eve

I would think that Troy alludes to his very extensive piece detailing how and how not to do password resets. http://www.troyhunt.com/2012/05/everything-you-ever-wanted-to-know.html http://www.troyhunt.com/2012/05/everything-you-ever-wanted-t... I think the point about password hints is that, like secret questions, they typically reduce the security of the account when used by actual users. Alternative approaches protect users from themselves.