How do you guys handle a lost password on your site. I am thinking of switch from the secret question paradigm to one where we use their unique id plus the email we have on file for them to send them a link that they must then log into their email account, click on the link then confirm. This applies two different layers of security. What do you think?
...
Go to the complete details ...