[Ikopar]

If sending a username and password through email when someone forgets their info is such a bad idea, then why do so many sites do it, and what better way is there?

[Roombor]

Why is it a bad idea?
Yeah
So does it when the users enters his password on your site
(unless you use https :)

[Ikopar]

Yeah, for that i'm hoping to use some kind of encryption

[Roombor]

Do you think it's necessary for your site to have that kind of security?

[Ikopar]

Probably not, but people i've talked to have kind of made me paranoid

[Roombor]

Haha :)
You can send out pgp encrypted mail ;)

[Ikopar]

Oh man, i don't know if my hosting thing supports that, i've never even heard of it

[Roombor]

Btw you dont have to send the password in the mail

[Ikopar]

What else would i do, create a link with a random key in it that gives them the password on my site?

[Roombor]

Yeah something like that
Theoretically they can sniff out that link ofcourse