On: Can you trust 37signals with your password?

[Hexstream]

It is true that 37signals emphasizes making the lives of their customers easier. To a fault.

But I don't see how the password recovery feature would be any less easy and convenient if it consisted of sending an email with a password reset link that brings you to a page where you just enter a new password twice and get logged in immediately. You have to deal with password reset link expiry and such but no big deal.

[sgk284 → Hexstream]

A lot of people don't like changing passwords.

[rufo → sgk284]

You don't have to change it. Type in the same password if you really want.

Of course, if you knew what the password was in the first place, you wouldn't have needed to reset your password...

[thaumaturgy → rufo]

I can come at this from the other end: part of my consulting deals with end-users on a daily basis, and I've seen even novice users _finally_ starting to use multiple passwords on their own without prompting.

So, it more likely would be a simple case of their forgetting which password they used on that particular system.