Hacker News Reader

This makes more sense, random users being able to request RESETS. I agree sending a time bound link to registered email is better.

What type of token generation mechanism would you use to send with the link to identify a user or to make sure that the link is being requested by the right user.

View on HN

I can't think of anything in particular you'd need to worry about. Something long enough that it would be infeasible to try and attack. We just use GUIDs, but those may be predictable if you know the generation time (I'm not sure about that, to be honest).

I do exactly the same thing.

The guid is set to expire after a period of time and requires that registered email and the key together. It won't allow login, only changing of their password.

Reply on news.ycombinator.com