Is everyone ok with the password being mailed out in plain text? (as one of these flows does, and Hacker News does itself)
Even if doing this on password creation doesnt imply that the passwords are stored plaintext, by emailing out the password, it can be sniffed over wifi or unsegmented wired networks, or read on intermediate servers, in your caches, in your backups, etc. Fairly low-hanging fruit.
Same idea (one-time URI) but with client-side encryption and sender's email notification (including IP & geolocation of receiver): https://whisperpassword.com/
Nearly all websites mail out replacement passwords (or password reset tokens) in plain text. That is not good but is hardly unique to HN.
I was about to say "HN doesn't do SSL" but just tested and it does. I wouldn't make a habit of this though - the site struggles with current traffic levels as it is.
Password reset tokens are single-use. If the resets are time- and IP- limited then attacking them is awkward (reset a password while the victim's in the same room?)
I don't think "nearly all" is right. I've never worked on a site which mailed out plaintext passwords; and I can't think of a site I regularly use (other than HN) that does it. However, I tend to close accounts if sites mail me plaintext passwords - so my sample's a bit self-selecting.
Even if doing this on password creation doesnt imply that the passwords are stored plaintext, by emailing out the password, it can be sniffed over wifi or unsegmented wired networks, or read on intermediate servers, in your caches, in your backups, etc. Fairly low-hanging fruit.