I am trying to understand something about the membership api. Users come to make payments on this website we built (membership api) but have forgot their password and security question (so they can not get the replacement password sent to them).
I am emailing passwords to the user if they answer security question correctly.
Our client's users keep forgeting their security Answer. Now the client wants to know if we can get rid of it.
Would it be a security risk to email reset passwords without asking the security question? If so, please give an example.
...
Go to the complete details ...