I’m at the point where if I don’t build the stuff myself, I won’t understand it, and I’ll end up doing something stupid. Ended up backtracking a bit after trying to borrow some code from the RoR forum ‘Beast’, for example – it didn’t save me the time I thought it would, because I didn’t know what the hell was going on. On the other hand, I understand my own forum code just fine.

I’m a bit surprised that most web frameworks don’t provide this kind of functionality out of the box. You really shouldn’t need to build most of this stuff (users/logins/passwords, etc.).

You type in your email, you get a big secret key (assuming, of course, that email matches an account). That mail mentions pretty much nothing besides that key and some simple instructions.

The difference is, key in hand, you get a form where you have to provide the username that owns this key (mild authentication: it might be obvious, but this wasn’t in the email that contained the key). Only then you get the no-previous-password password change form.

My general feelings about the forgotten password mechanisms align with what you put above, which explains why we reached nearly the same solution.

I now have several sites where I use “I forgot my password” process instead of actually trying to remember my password. This disturbs me, but my lazy nature demands that I take the easy way out.