Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

As a site user, I'd want to just have a link I can click to pick a new password.

I'm not going to use/keep the generated password you send me, so just linking me to a page that lets me pick a new password to begin with works best for me.



Hmm...interesting. Click wise it probably is less clicks and you are also forcing the user to change his password. Unless you add logic to ask the user to change his password with one time token, it probably makes more sense to send a link to reset pwd.


You may want to look into using HMAC Urls (with a timed expiration date), see http://en.wikipedia.org/wiki/HMAC for a quick explanation.

This lets you send a link like www.mysite.com/resetpassword?userid=123&timestamp=...&hmac=.... without having to keep a database backed copy of 'reset password' emails and tracking sent links.

You can make it so the link only works for say a few hours or any other combination of factors, the HMAC lets you 'sign' the URL you issue the user so it cannot be changed/forged, and you append a 'timestamp' argument to then let you determine if you consider the URL too old to take action on.


That's a brilliant idea




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: