3 ms·
No; compromising the password reset URL lets an attacker change my password for that service. It leaves a clear audit trace on my end (the email) and it doesn't
by akerl_ 12y ago
No; compromising the password reset URL lets an attacker change my password for that service. It leaves a clear audit trace on my end (the email) and it doesn't grant them my plaintext password (way too many people reuse passwords, so a plaintext password is likely to be reusable).
If I didn't request the reset myself, the email alerts me to mischief. If I did, and they use the URL before me, the fact that the URL doesn't work when I use it alerts me.