Orangescale Studio

Website that has membership feature will have (should!) have this feature. In most cases, the mechanisms are almost the same. Something like this:

• User visited a password reminder request page.
• Fill in account-related field — can be username, email address, or combination of both values.
• If the data is recognized, a confirmation email will be sent to user’s email address.
• User will receive an email to confirm whether he/she want to reset/retrieve a new password.
• If user really want to do it, they will follow a link, their password will be reset. Website will send a newly generated password, OR the original password (depending on the website program)

Of course, that’s not the exact order, but usually there are similar steps: request, validate, and confirm.

But, today, I got different story. And, I think it’s pretty weird. I got an email telling me that my password is reset. In short: my password has changed, even I did not request to change/reset my account password. See the problem here?

This is a nightmare because everyone — who knows about members’ username or email address — can abuse the account by changing users’ passwords in the system. Bad. Bad. Bad. This is wrong. Really wrong.