Hacker News Reader

Well, the sysadmin could click on "restore password" on that super-secret site they want to steal your password to, and then check your mailbox. So this is really no different in terms of security.

Also, I'm sure I have a dozen restore password emails in GMail somewhere. And I'm sure I'm not alone.

View on HN

Generally, password reset links will have a timeout associated with them. Also, if someone does manage to use the password reset link in your mailbox and reset the password before it expires, you will come to know that your password is not working anymore, and you can act on it. It's not same as someone silently logging into your account through your email. This doesn't in anyway mean that it's safe to send password reset links to your mailbox if it's already compromised, though.

> I'm sure I have a dozen restore password emails in GMail somewhere

Maybe that should be the next Google Labs feature. The 'Mission Impossible' option. (i.e. 'this message will self-destruct')

Reply on news.ycombinator.com