Comments on: LOVEFILM forgotten password antipattern

By: Simon

Simon — Mon, 14 Jul 2008 18:58:29 +0000

Whats even more annoying is there doesn’t currently seem to be a way to change your password once it has been reset.

This has had me looking on the website for quite a while. Its in none of the obviously places.

By: mad_dog

mad_dog — Thu, 27 Mar 2008 09:18:53 +0000

Hi,

Actually this mechanism for password resets (sending a reset to your registered email address) is fairly common on the web. Some sites are even silly enough to send the existing password in the clear, rather than a random reset.

I guess that I could sign up for tons of spam using your email address but would you complain that there was a flaw in such a system? If I know your email address and want to cause hassles for you, there are more inventive ways of annoying you than resetting your lovefilm ID.

Much more important is how personal details are protected! I’d worry more about that than a password reset. As a means of DOS attack, it would be pretty lame and easily spotted.

By: Jon

Jon — Tue, 25 Mar 2008 00:25:12 +0000

At least you know that they are encrypting your password.

Too many websites store passwords in clear text and simple email you your existing password if you hit the “forgot password” button.

By: Hendrik Mans » LOVEFILM forgotten password antipattern

Hendrik Mans » LOVEFILM forgotten password antipattern — Sun, 23 Mar 2008 11:24:28 +0000

[...] LOVEFILM forgotten password antipattern. There are sites out there that still do that? Weird. [...]

By: James Urquhart

James Urquhart — Sat, 22 Mar 2008 22:35:02 +0000

Reminds me of very similar functionality in the popular web based Project Management solution, ProjectPier. If you just so happen to know the email address of any user in the system, you can quite simply reset their password via the “Forgot Password” screen.

Absolutely ridiculous, imo.

By: jankees

jankees — Sat, 22 Mar 2008 21:59:36 +0000

That is pretty stupid indeed, I don’t understand why openID is so rarly used…

But Aral, weren’t you a Flashprogrammer? You only write about other stuff (not that it is not interesting but I’d love some more swx…)

By: Aral

Aral — Sat, 22 Mar 2008 21:13:27 +0000

LOL

By: Anonymous prick

Anonymous prick — Sat, 22 Mar 2008 21:02:59 +0000

So…. what’s your email address?