101 reputation
2
bio website adam-robinson.net
location Charlotte, NC
age 31
visits member for 2 years, 2 months
seen Sep 10 '13 at 17:24

I'm a developer in a small software firm in Charlotte, NC.


Dec
15
awarded  Supporter
Aug
1
awarded  Autobiographer
Aug
1
comment Is sending password to user email secure?
@AndreyBotalov: True enough, deleting it is an implementation detail, but it seems the most practical thing to do (what would be the purpose in keeping it around?) rather than adding logic to determine whether or not the token is valid.
Aug
1
comment Is sending password to user email secure?
The entire request URL is encrypted in HTTPS; this is why secured domains must be hosted on dedicated IP addresses, as certificate selection can't be based upon the request address since that information isn't available to the server until after the session has been negotiated. Even so, if the token is one-time-use-only, what would even be the harm in its being sent in plaintext? By the time anyone could have observed it, it won't work anymore.