    private function _new_password($user_id = 0, $password, $token)
    {
    	$auth = Auth::instance();
		$user = ORM::factory('user',$user_id);
		if ($user->loaded == true)
		{
			// Determine Method (RiverID or standard)

			if (kohana::config('riverid.enable') == TRUE AND ! empty($user->riverid))
			{
				// Use RiverID

				// We don't really have to save the password locally but if a deployer
				//   ever wants to switch back locally, it's nice to have the pw there
				$user->password = $password;
				$user->save();

				// Relay the password change back to the RiverID server
				$riverid = new RiverID;
				$riverid->email = $user->email;
				$riverid->token = $token;
				$riverid->new_password = $password;
				if ($riverid->setpassword() == FALSE)
				{
					// TODO: Something went wrong. Tell the user.
				}

			}
			else
			{
				// Use Standard

				if($auth->hash_password($user->email.$user->last_login, $auth->find_salt($token)) == $token)
				{
					$user->password = $password;
					$user->save();
				}
				else
				{
					// TODO: Something went wrong, tell the user.
				}
			}

			return TRUE;
		}

		// TODO: User doesn't exist, tell the user (meta, I know).

		return FALSE;
	}
The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.