Quote from: InvoKing on April 16, 2018, 06:32:20 PM

/srs : I fail to understand why retrieving your password by entering your username is enabled. Email is sufficient and more secure.

What if you can't remember the email address you used?

Though I agree this process could be improved, because even still the user will have to check every email acccount for the email.

For example a better process would be, user enters their username, website shows the user the first few characters of the email and domain ( such as una******@gma**.com) and asks them to enter the full email before sending the reset email. Whether the email is correct or not, you display the same message such as "If that is the correct email address a reset email will be sent to it". Though the problem here is you risk exposing the users email address (such as in my example the you could easily guess the email is unabomber@gmail.com) however it is the process that most of the big websites are using right now and seems like a fairly good balance between security and usability.