I am wondering about ramifications of trying to use a web service for the password reminder functionality.
Does anyone know of articles or tutorials about the best practices for allowing a user to reset or recieve a password reminder via a web service, or even a temporary password?
I am not too comfortable passing reminder information over the service even if it is SSL.
My expectations here are that a web server using ASP Membership and Roles, manages a user account and profile. If the user forgets his/her password, I would like a client side app to permit a reset reminder email rather than using a web page on the web site. The client side app could be a CE or Android application, etc. And connectivity would happen over the public internet.
Seems feasible to me just worried about security.
Thanks for any ideas or help.
...
Go to the complete details ...