title: Password reset by emailing temporary passwords
body: <p>A group in my company is implementing a single-sign-on REST API for our applications.  This authentication service has a password reset function.  The application sends the username to the reset function.  If that username is associated with an email address, then an email is sent to that address with a temporary password.</p>
  
  <p>The other approach seems to be sites which email a secure, temporary link which presents a page for the user to input a new password.  This page only exists for a short period of time.</p>
  
  <p>I know that email is not a secure protocol, so people could sniff the traffic and recover either the temporary password or the temporary link.</p>
  
  <p>Are there any significant security reasons to prefer one method over the other?  Is there another, more secure way to do this?</p>