lost/reset password system needs work

[jbroder]

I have two VB installs, running 3.0 and 3.6.

My users are not always the most tech-savvy, and so they get really confused by the lost password system.

The way the standard lost pw system works is that it emails the user a link to generate a new numeric (ex: 3450596) password, and then requires the user to use the user cp to change the password to something the user wants.

What would be more user-friendly, in my opinion, would be to bypass the numeric password, and send an email that says click here to update your password.

The change password url would have some sort of quick-expiring querystring hash to prevent unauthorized access.

I think this would be as secure as the existing system, since both will allow the email recipient to change the password. Mine just has fewer steps for the user to take.

I have been searching here for a mod like this, and didn't see any, but "lost password" is not a very unique search string, so maybe it is there and I just can't find it.

Does anyone know of a mod that does this?

Does anyone think this would be useful?

Does anyone think this is less secure than the existing system?

Thanks for a great site. I hope I put this in the right forum. I come here whenever I need something, and it always works out.

Jon