> If you're saving a token in the database to delete, you're doing it wrong anyways. I think the strength of your statement here is not warranted – in the cont

> If you're saving a token in the database to delete, you're doing it wrong anyways. I think the strength of your statement here is not warranted – in the context of security, there's no flaw from doing that. Likewise, saying "HMAC" is "the right way"... well, I wouldn't agree with that. If you do HMAC, you only have time-based expiry. Thomas was talking about tokens sitting in email inboxes that are still valid and are effective passwords... you can't make your HMAC tokens expire as soon as they're used, so that's still a concern.