Page MenuHomePhabricator

Provide mechanism for user to report back that they did not request a password reset
Open, MediumPublic

Description

What it says on the tin. A nice little discussion about password resets on enwiki brought up the idea of being able to say "Yo I didn't ask for this password reset!" Facebook/Google/others do something the same.

The best use case I can come up with would be storing that data (in aggregate) so we could identify if there's an IP (most likely range) that is abusing password resets to try and get into accounts.

Might be a terrible idea, but I'm bored and it's a Sunday so here we are. Feel free to tell me I'm an idiot :P