3 ms·
Alternatively however they're sending password reset links in plaintext to users. Either way if the communication chain is compromised so is the user's security
by mikeryan 12y ago
Alternatively however they're sending password reset links in plaintext to users. Either way if the communication chain is compromised so is the user's security.
- akerl_ 12y agoNo; compromising the password reset URL lets an attacker change my password for that service. It leaves a clear audit trace on my end (the email) and it doesn't grant them my plaintext password (way too many people reuse passwords, so a plaintext password is likely to be reusable). If I didn't request the reset myself, the email alerts me to mischief. If I did, and they use the URL before me, the fact that the URL doesn't work when I use it alerts me.