What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 129 Stack Exchange communities.

I tried SO password recovery,

you enter your email and a captcha after you get an e-mail:

here's your password : aaa3437

just kidding, 

go to this link ....

is it considered a bad idea to generate a random password and send it to the e-mail ?

for example:

1: send an email with a password reset link
2: click on the link, pass reset occurs, send email with new password
share|improve this question
    
Probably, maybe they want all password changes done on their website. ?? –  Mob Sep 10 '11 at 19:41
4  
Man, that's hilarious. I approve. –  Matthew Read Sep 10 '11 at 20:17

2 Answers 2

up vote 8 down vote accepted

We don't ever send passwords in emails, that's a big no-no. We send single-use recovery links, like the one that e-mail contains.

Even temporary passwords don't make any sense. You don't actually want someone to use those, you want them to immediately reset them; so making someone copy/paste one into a form is just pointless busy work.

As Michael points out, it's a joking "take that" at the depressing number of sites that get this wrong.

It's also worth noting that the "joke passwords" sent in those emails are not sufficiently complex to be used with our OpenID provider. The code to generate them can be found here; it uses a list of common passwords, minus some of the more risque ones.

share|improve this answer
    
about the single-use recovery link, the code in this link is used until the password is changed or you just keep creating new single use codes for each request ( the user might do several posts e.g. passwords don't match) –  Omu Sep 12 '11 at 13:13
    
btw, if you just click 'Change Password' on the recovery form without filling anything you get the message "Password cannot match your account name, in whole or in part." –  Omu Sep 12 '11 at 13:20

I imagine the joke is "here's your current password"; passwords should be stored in a way that makes recovering the original impossible, so claiming to have the current password is making fun of all the sites that fail at password storage. As for issuing you a random password, most people are probably going to change it immediately anyway, so they might as well cut out that step and just give you a link directly to a page that lets you set a new password

share|improve this answer
1  
As seen on <del> TV </del><ins> Server Fault </ins> –  Pops Sep 12 '11 at 13:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .