Add: notion of single-use random link for password resets

1 files changed, 3 insertions, 1 deletions

diff --git a/yuck.mdwn b/yuck.mdwn
index 472504b..6e4f65f 100644
--- a/yuck.mdwn
+++ b/yuck.mdwn
@@ -167,7 +167,9 @@ reference in discussions.
   need.
 * (PRIVACYLEAK) Yuck MUST NOT leak personal information.
 * (PWRESET) Yuck MUST support the user resetting their password,
-  securely.
+  securely. Possibly by supporting a random, single-use link that can
+  be communicated to the user (perhaps via email) to allow them to
+  change the password.
 * (TEMPLOCK) Yuck MUST support locking an account temporarily, if it
   is the target of too many failures. This is to avoid an attacker
   from brute-forcing a password by trying many times.