If HN replaces your password with a random one when requesting a forgot password, that's a great way to denial of service someone -- just keep requesting new passwords every 10 seconds and they'll never be able to login.

The better approach is to generate a secure password change link with an expiring change request token. Upon clicking the link, the token is validated and you're allowed to set a new password (or have one randomly generated). However, until the link is clicked and the token validated your old password should remain the same.

> Far less likely is that someone could be trying to discover/exploit a timing attack on the forgotten password generation algorithm.

Didn't somebody do that already?

It was the session cookie key not the password, and it wasn't really a timing attack in the sense the parent means.

But yeah http://news.ycombinator.com/item?id=639976