Password recovery is stupid: should ask for either username or email, not both

[teo8976@…]

There are two kinds of decent "forgot your password" procedures:

• those which ask you to enter your email
• those which let choose whether to enter the username or the email

Asking for both is stupid (as would be asking for the username without the option to use the email instead), as one may have forgotten the username.

It's pathetic that in 2016 we still see sites that ask for both username and email for password reset.

[Jun Omae]

PluginIssue (​th:AccountManagerPlugin).

[Jun Omae]

I'm guessing the reason is that multiple users can have same email address in Trac.

[anonymous]

Then

1. entering only the username should be allowed
2. you should allow to enter only the email and, only if multiple users with that email exist, tell the user so and require him/her to enter the username

[anonymous]

(this shit removed the newlines from my comment and now it doesn't let me edit it? Fucking ridiculous)

[anonymous]

(oh I see why, it's because it didn't require me to register in the first place in order to comment, so I commented as anonymous. Can't believe how shitty this whole thing is)

[Jun Omae]

If you think that behavior is a defect, you can create a ticket for ​​th:AccountManagerPlugin on trac-hacks.