Password Reset without Confirmation Code

[shefik]

Most sites just send a "password" reset email to the email address on file, and the user clicks the link to create a password and that's it - the user can then select a new password.

We currently have a two-step password reset with the additional confirmation code. Is a confirmation code necessary? Or, can we just go with a password reset email sans the confirmation code?

Perhaps it can be an option for the site admin to choose whether they want password reset to require a confirmation code, or not.

[damon18]

Please consider simplifying the lost password process. This has been the source of 90% of the support issues on my larger membership sites since I started with Postnuke. People have never seen this process anywhere else and it just confounds the dickens out of them.

To many times they try to login using the confirmation code as a password, then they think the site is broken.

[craigh]

👍

[Guite]

My proposal:

• completely remove password reminder ("Password Reminder" is not actually doing anything. #1682)
• make lost password functionality easier to use (like described in Password Reset without Confirmation Code #1781)

Any objections about this?

[rallek]

👍

[cmfcmf]

👍

[craigh]

@Guite this feature should be implemented ONLY in ZAuth please. Users no longer manages passwords.