Sending user passwords in the clear

[eluser]Thorpe Obazee[/eluser]
[quote author="Dregond Rahl" date="1242638478"]Could create a field in the DB to act like a flag, if a user requests for a lost password, the account is flagged, so then the lost password token is activated, if it isn't flagged it won't work even if you get the right one. After password is changed, the token changes and the account is unflagged.[/quote]

I don't know but isn't that the same thing? Anyway, what I mean is that the page should ask for something 'personal' or 'secret' like a secret question thats' meant to be answered by the user on that page.

what do you think?