title: Is password recovery link more secure than plain-text password transfer when considering man-in-the-middle attacks?
body: <p>Considering <a href="http://www.fishnetsecurity.com/6labs/resource-library/white-paper/best-practices-secure-forgot-password-feature" rel="nofollow">this paper</a> and simple common sense: why is latter more vulnerable than former?</p>
  
  <p>I mean, if we have eavesdropping situation than what is difference between two scenarios:</p>
  
  <ul>
  <li>Plain-text: hacker requests password recovery, catches the password, gains access to the account</li>
  <li>Recovery link: hacker requests password recovery, catches the link, uses it, gains access to the account</li>
  </ul>
  
  <p>I know that we mustn't store the password as plain-text at all, but lets assume that we have no control over this part — is there any difference in this case?</p>