title: Implement password recovery best practice
body: <p>I want to to implement password recovery in my web application.</p>
  
  <p>I'd like to avoid using secret questions.</p>
  
  <p>I could just send the password by e-mail but I think it would be risky.</p>
  
  <p>Maybe I could generate a new temporary random password and send it by e-mail but I think it is as risky as the above point.</p>
  
  <p>Can I send a url by e-mail for example <a href="http://example.com/token=xxxx" rel="noreferrer">http://example.com/token=xxxx</a>
  where xxxx is a random token associated with the user. So when the user navigates to that url he/she can reset the password.</p>