Web Security · Junior · Question 61 of 75
How should a "Forgot password" link work?
- ✓Correct answer: Send a single-use, short-lived random token by email; never send the current password
- 2Email the user their current password in plain text
- 3Show a security question whose answer is the user's birthday
Explanation
If the site can email your current password, it stores it in a recoverable form. Reset tokens must be unguessable and expire quickly.