从可用性角度来看，实现密码恢复的最佳方法是什么？
我阅读了有关 SO 的其他密码恢复问题，似乎大多数人都认为发送只能使用一次并在几天后过期的密码恢复链接是最安全的。
现在我的问题是，（我知道这是主观的，但我正在寻找您可能从用户那里收到的输入）
这对用户来说也相当舒适吗？我所说的用户是指你的祖母，而不是你的同事。
I read the other password recovery questions on SO and it seems that most people consider sending a password recovery link that can be used only once and expires after a couple of days to be most secure.
Now my question, (I know it is subjective, but I am looking for input that you may have received from your users)
Is this also decently comfortable for users? and by users I mean your grandmother not you co-worker.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
作为用户，我喜欢可以选择自己选择的新密码，然后向我发送激活邮件，提供可点击的链接以使新密码生效。
我不喜欢向我发送新的一次性密码，让我登录并在我的个人资料中编辑它。
不过，最棒的是可以使用 OpenID 登录，因此我根本不需要保留任何密码。
As a user, I like when I can pick a new password of my choice, then have an activation mail sent to me, providing a clickable link for the new password to take effect.
I do not like when a new one time password is sent to me, having me to log in and edit it in my profile.
Best of all, though, is to have OpenID login, so I don't have to keep any password at all.
有什么比单击激活链接并输入新密码更简单的呢？
What can be simpler than clicking an activation link and entering a new password?
在访问控制、可用性或安全性方面，您的网站的重点是什么？
如果它的可用性那么也许以纯文本形式存储密码并允许根据请求将它们发送到注册的电子邮件地址就足够了，并且可能比更安全的替代方案更有用。
如果安全是答案，那么陷门编码和密码重置是更好的选择。
What is the focus of your site when it comes to access control, usability or security?
If it's usability then perhaps storing passwords in plain text and allowing them to be sent to the registered email address upon request is sufficient and potentially more usable than the more secure alternative.
If security is the answer then trapdoor encoding and password reset is the better option.
根据经验，我建议如下：
虽然从纯粹的可用性角度来看这可能并不理想（在理想的世界中，您不必拥有首先是密码，让我们面对现实吧），但它确实会尝试确保您执行合法的密码重置。
或者（或者确实与上述结合使用），您可以允许用户存储一个简单的密码提醒文本字符串，该字符串也出现在第一封出站电子邮件中。 （如果他们在这个阶段意识到密码是什么，他们可以简单地输入密码，而不必执行重置。）但是，我不建议在网站本身上输出此密码，因为它可能是一个太强的线索。
Based on experience, I'd recommend the following:
Whilst this might not be ideal from a pure usability perspective (in an ideal world you wouldn't have to have a password in the first place, let's face it), it does however attempt to ensure that you're carrying out a legitimate password reset.
Alternatively (or indeed in conjunction with the above), you could allow the user to store a simple password reminder text string that's also present in the first outbound email. (If they realise what the password is at this stage they can simply enter it rather than having to perform a reset.) I wouldn't however recommend outputting this on the web site itself, as it's liable to be too strong a clue.
从可用性角度来看？如果连续三次登录失败，则假设他们确实忘记了密码，无论如何都让他们登录并提示更改密码。
我见过的针对低安全性帐户的最佳系统之一是邮寄链接。用户无需记住站点 URL、用户名或密码。该网站无法了解用户在管理密码方面的任何弱点。
From a usability perspective? If a login fails three times in a row, assume they have legitimately forgotten their password, let them in anyway and prompt for changing the password.
One of the best systems I've seen for low-security accounts, is to mail a link. No need for the user to remember site URL, username or password. The site doesn't get to know about any weaknesses the user has in managing passwords.