I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the two approaches.
The original point was whether it was more secure to send out a password reset link when a user forgets their password to a website, or whether to send the original password unencrypted in an email.
Now not salting and encrypting a password is bad because when the database is eventually stolen from the website the attacker will have all the passwords clear as day. OK fine, I get that.
But if we ignore the possibility of the database being stolen and only look at the user forgetting their password and going through the "forgotten password steps"; is it more, the same or less secure to send a reset link over a plain text password in an email?
My thinking is that it is the same. Because if an attacker has access to your email by any means (he knows your email login details, or he's snooping the traffic somewhere) he therefore has access to the plain text password that's sent or the reset link - even if it is a limited time link.
The attacker could reset your password before you even know you have an email.
Is my thinking here flawed?