Is it better to reset password or send lost password back?
email, passwords, security
Solution
Sending them lost password implies that you're keeping them in plain text or encrypted in two-way encryption which is not safe.
I'd suggest following Wordpress mechanism for reseting the password:
- Send a link with confirmation of password reset
- Follow confirmation link to the page which would generate random password and send it to the user
- Let user login with new password and change it to something better remembering.
Problem
Is it better when a user forgets their password to have them reset their password or to just send the lost password back to them?