3 ms·

Well, what would you do with an encrypted password sent to you by email? How do you propose to solve this? Using password reset links instead changes very littl

• __david__ 12y ago
  > Using password reset links instead changes very little. Actually it changes a lot. Password reset links are one time only, and they get sent before you change your password. Mailing your password in plaintext after you've just changed it means it's good even if someone gets a hold of it months or years later. That's significantly worse.
  • joesb 12y ago
    Password can be one time password, too. Require user to change their password the first they login is not an advance feature.
    • __david__ 12y ago
      Of course they can be, but that's not what we're talking about here. Please read the ancestor comments.