By the way, there are two sites I go to, one for work, one for leisure that have zero way to reset your password.
The work related one requires someone from our company who's designated the contact for such things, calls the other company and confirms my work e-mail address and then they manually trigger a temporary password e-mail.
Getting that one changed is a total PITA.
The non-work one requires an e-mail to a cranky guy who manually sets a new password.
Less of a PITA but certainly not current best-practices. Other than the cranky part.
My favorite was a token/RSA key at a former employer used to log deep into the bowels of a 135+ year old telecom company (that gives it away, by the way).
Inside that company, if your token got out of sync, you could go to a website and type in the next three numbers that came up along with your PIN, and reset it.
Contractors and vendors had to call some building in Florida and read the numbers to a company employee who'd type them in for you.
One day we called to do this and there was a voice mail message...
"The entire department that handled this function was laid off. Thank you for calling. (click)"
We laughed and called up our usual contacts. They struggled for two months to fix that RSA key and gave up. There really was no one left with access to reset other people's tokens. Worldwide.
Finally their Director just ordered a new one for the person because there WAS a group to synchronize NEW ones, and that process still worked.
The old key was sent USPS back to the address in Florida, as directed, and as far as I know is probably still sitting in someone's mail slot there who will never return.
We never implemented it, but "Operation Webcam" was considered with the one working RSA token at one point in time. Share the supposedly personal PIN number and stuff the token in a overhead drawer at an empty cubicle with a lamp and a webcam.
Would have worked. So much for fancy "security".
