A particular service I use, when asked for a password reset, showed me an identifier on the website - something like 4562708546, apparently random or sequential.
They then sent me a new password over snail mail. Besides the (plaintext) password, the letter I received contains the identifier (4562708546), and asks me to verify that it is the same as the one the website showed me. The letter doesn't contain the username.
I've thought a bit about this, and can't figure out why they do it:
- Only a single letter was sent, so a MITM interested in learning the password doesn't need to know the identifier to know the correct password
- It could prevent accidental malfeasance in case a user receives a letter meant for someone else - but they would have no way of logging in without knowing the other person's username in the first place. And if they know the other's person username, it's probably not accidental.
What could be the purpose of such verification?