Redux Authentication 1.4a (24th July 2008)

[eluser]trice22[/eluser]
Thanks for your fast reply.
What I meant was, that the system wouldn't create a password at all for you, in case you click the "forgot password"–link (or similar). You would have to rather first identify yourself (provide e.g. your email address), then you'd get a link with a unique and encrypted id (let's say "http://www.domain.com/user/reset/SGDwq4e67tfagsrkasfh/") sent by email and following this link, you'd be able to just set a new password within a certain period of time.

I'm far from being an expert on security, but I found this idea very convenient and appealing from a user experience point of view. If you get an automatically created password, you'll have to probably either save it somewhere besides your head or change it (at least I'm having trouble remembering more than two of those kind of auto–generated strings)—the first option is a security risk, the latter one extra step for the user to go. In probably any case you'll copy the password at some point into your clipboard, which again might eventually be a security issue.

I personally find these "secret questions" pretty annoying (no offense), since the ready options rarely provide me with a question I'd like to answer in an online form (or at least honestly answer to, which means I'll forget my fake answer during the next split second) and you can after all never be sure how (like in how many words, case, etc.) a user might answer a question one day or the other.
A unique link on the other hand is as secure or insecure as sending a new password straight after providing an email address (like many applications handle it atm.) but let's the user set a new password as he/she wishes to, which has never been sent via email.

Don't get me wrong—I believe that you're providing a good and secure solution inside a great library, I'm just making a suggestion from a personal perspective.

@michael Wales—if you're around, could you maybe elaborate a bit, what you were writing about? Unfortunately your older posts seem to have not survived the redesign/move of your blog.

—trice

P.S.: When are you expecting 1.3 to be out?