"Never send the user a new password over email."

This is what HN does right now. I know, because I forgot my password just yesterday.