Password notification email
You must add a |reason= parameter to this Cleanup template – replace it with {{Cleanup|February 2006|reason=<Fill reason here>}}, or remove the Cleanup template.
A common technique used by websites, if a user forgets their password, is to send a password notification e-mail containing enough information for the user to access their account again. This method of password retrieval relies on the assumption that only the legitimate owner of the account has access to the inbox for that particular e-mail address.
The process is often initiated by the user clicking on a forgotton password link on the website where, after entering their username or e-mail address, the password notification e-mail would be automatically sent to the inbox of the account holder. Some websites, such as Dating Direct, include the password in every e-mail sent from the website. This has the problem that all of the e-mails recieved must be treated with the same security as a password notification e-mail.
The email sent could contain a new, temporary password for the account or a URL that can be followed to enter a new password for that account. The new password or the URL often contain a randomly generated string of text that can only be obtained by reading that particular email. This is a very common technique used by websites such as Gmail and LikeMynds.
Another method used is to send all or part of the original password in the email. Sending only a few characters of the password, a method employed by Friends Reunited, can help the user to remember their original password, without having to reveal the whole password to them.
Problems with password notification emails
The main issue is that the contents of the password notification email can be easily discovered by anyone with access to the inbox of the account owner. This could be as a result of shoulder surfing or if the inbox itself is not password protected. The contents could then be used to compromise the security of the account. The user would therefore have the responsibility of either securely deleting the e-mail or ensuring that its contents are not revealed to anyone else. A partial solution to this problem, emloyed by websites such as Google Accounts is to cause any links contained within the e-mail to expire after a period of time, making the e-mail useless if it is not used quickly after it is sent.
One problem with sending the original password in the e-mail is that the password contained within could be used to access other accounts used by the user, if that user had chosen to use the same password for two or more accounts.
E-mails are often not secure so, unless the e-mail had been encrypted prior to being sent, the contents could be read by anyone who eavesdrops on the e-mail.