title: How to Implement Password Resets?
body: <p>I'm working on an application in ASP.NET, and was wondering specifically how I could implement a <code>Password Reset</code> function if I wanted to roll my own. </p>
  
  <p>Specifically, I have the following questions:</p>
  
  <ul>
  <li>What is a good way of generating a Unique ID that is hard to crack?  </li>
  <li>Should there be a timer attached to it? If so, how long should it be?</li>
  <li>Should I record the IP address? Does it even matter?</li>
  <li>What information should I ask for under the "Password Reset" screen ? Just Email address? Or maybe email address plus some piece of information that they 'know'? (Favorite team, puppy's name, etc)</li>
  </ul>
  
  <p>Are there any other considerations I need to be aware of?</p>
  
  <blockquote>
    <p><strong>NB</strong>: <a href="https://stackoverflow.com/questions/522967/forgot-password-what-is-the-best-method-of-implementing-a-forgot-password-functi">Other questions</a> have <a href="https://stackoverflow.com/questions/270485/password-management-best-practices-soup-to-nuts-not-just-storage-or-generation">glossed over</a> technical implementation entirely. Indeed the accepted answer glosses over the gory details. I hope that this question and subsequent answers will go into the gory details, and I hope by phrasing this question much more narrowly that the answers are less 'fluff' and more 'gore'.</p>
  </blockquote>
  
  <p><strong>Edit</strong>: Answers that also go into how such a table would be modeled and handled in SQL Server or any ASP.NET MVC links to an answer would be appreciated.</p>