title: Best practice for resetting forgotten user passwords
body: <p>As far as I can think, there are two reasonable ways to reset a user's forgotten password.</p>
  
  <ol>
  <li><p>Have the user enter their email address and a new plaintext password is sent to their email address.</p></li>
  <li><p>A link is sent to their email address which has a UID number in the URL. Clicking on this takes the user to a form on the website where they can choose there own new password.</p></li>
  </ol>
  
  <p>Which method is preferable and why?</p>
  
  <p>If method 1 is used, perhaps a third party could read the email and obtain the new password.
  If method 2 is used, what is to stop someone methodically going through UID codes to try and access the form to change a user's password?</p>