title: How to keep passwords safe when a "Forgot Password" function is available
body: <p>A colleague and I are discussing how to implement "Lost Password" feature on our company's proprietary web application.</p>
  
  <p>We have already decided that to create an account there will be three required elements</p>
  
  <p><em>1) Screen Name
  <br />2) Email Address (used for logging in)
  <br />1) Password (obviously, also used for logging in. <strong>Stored as one-way hash</strong>)</em></p>
  
  <p>Once we have that info, the user attempting to sign up will be sent a verification email with a link and an activation key. To activate their account they will need to follow the link, enter the activation key, and re-enter their email and password. If everything matches then presto! A new user account is activated.</p>
  
  <p>After the account is activated, lets say that the user forgets their password. We have two ideas for how to handle this situation.</p>
  
  <h3>Idea 1</h3>
  
  <ol>
    <li>User clicks "Forgot Password"</li>
    <li>User is prompted for their account's email address</li>
    <li>If email matches active, non-closed account, then send a temporary password to the already validated email address</li>
    <li>User attempts to log in with temporary password</li>
    <li>If temporary password matches email address, prompt user to reset password. Prevent full login until temporary password is replaced.</li>
  </ol>
  
  <h3>Idea 2</h3>
  
  <p>This would require secret question and secret answer data to be collected during signup.</p>
  
  <ol>
    <li>User clicks "Forgot Password"</li>
    <li>User is prompted for email address and answer to secret question</li>
    <li>Upon validating both, user is then allowed to reset password</li>
  </ol>
  
  <h3>Concerns</h3>
  
  <p>One concern that we have is that (internal to our company) multiple employees would use a single login account. Some of us think that eliminates the secret question method as an option.</p>
  
  <p>However, a password sent by email (temporary or not) would be vulnerable as email is not secure.</p>
  
  <h3>Question Summary</h3>
  
  <p>Considering internal operational constraints (multiple people to single login) which of these ideas would be the most secure and user-friendly option? Or, are neither adequate?</p>
  
  <hr>
  
  <h1>Edit</h1>
  
  <p>Could the stack overflow help me out by evaluating the answers? There are few opinions expressed below, but there isn't any indication from SO as to the answers' quality.</p>