2

This is not as secure as one might want it to be: Assume an attacker visits a site and pretends to be some user of that site and to have fogotten the password. On the password reset page they can pre-enter the desired future password and a mail to the real owner of the account is sent. The real owner receives the mail and perhaps clicks the link because ...


Only top voted, non community-wiki answers of a minimum length are eligible