Password reset with e-mail OR username

[Jonas H.]

Some people don't remember with which of their five spam addresses they registered for a site, so it might be convenient to reset your password by entering your username. And the other way round for folks that forget their usernames but not their e-mail addresses.

The implementation approach in the attached patch is to guess whether the entered string is a e-mail or a username.

[Jonas H.]

(against 14922)

[Keryn Knight <keryn@…>]

Does this not further expose the ability to grief another user with reset-password emails? Usernames are more prevalent as (often persistent) online personas, and emails are, comparatively speaking, closely guarded (largely, I suspect, because of the deluge of spam).

In a scenario such as say, a forum, where people may not always get on, providing the ability to easily send a reset-password email to anyone who's username you can see seems like an open invitation to annoy.

[Gabriel Hurley]

I would tend to agree with Keryn. While some sites do allow you to recover accounts using data other than email addresses, it's not exactly common practice and definitely has the potential for abuse. If this were ever to be implemented it would need to be a much more comprehensive system, and is probably better suited to maturing in a 3rd party app first.