I spent a week consulting for a small education software start-up and was horrified when I saw that their password reset process was the following:

1. An anonymous person sends a message via Google Chat to the support Gmail address.

2. A staff member would ask the anonymous person for the username of the account for which to reset the password.

3. The anonymous person would present the username.

4. The staff member would reset the password and create a temporary password and would then give that anonymous person the password. The staff member would then explain how to change the password once the anonymous person had logged in with the temporary password.

I spent too long trying to explain to the staff and the CEO why it was a problem that any person could gain access to any account...