So your point is it is less secure because the same weak feature is being used more frequently?
> all it takes is someone to intercept those emails on their way from your SMTP server out to the wider internet
it doesn't matter when some user will create a reset request. Because you can do it for him, right?
There are tons of services out there generating a password for you and sending it over in plain text, which is exactly what I proposed. Do we see it heavily abused? The opposite is true - those services are more safe because they got rid of reused passwords.
Also there's a bunch of techniques i didn't describe to prevent some attacks. When user is trying to login save a secret token1 in a cookie and send token2 to their email. When the user clicks this link verify old cookies. This makes passive global wiretapping less useful (if it was your concern). Still vulnerable to more targeted attacks (enter username, wait for email, reuse cookie), but so "reset password" is.
> all it takes is someone to intercept those emails on their way from your SMTP server out to the wider internet it doesn't matter when some user will create a reset request. Because you can do it for him, right?
There are tons of services out there generating a password for you and sending it over in plain text, which is exactly what I proposed. Do we see it heavily abused? The opposite is true - those services are more safe because they got rid of reused passwords.
Also there's a bunch of techniques i didn't describe to prevent some attacks. When user is trying to login save a secret token1 in a cookie and send token2 to their email. When the user clicks this link verify old cookies. This makes passive global wiretapping less useful (if it was your concern). Still vulnerable to more targeted attacks (enter username, wait for email, reuse cookie), but so "reset password" is.