Unfiltered Story #32641

(We support a school learning platform. A user has enquired as to how the password reset function on our product works. I have advised that the user must enter their email and a password reset will be sent to that mail if an account is associated with it)

Customer: Well, I’m not happy with that at all. The students are too young to have email, so they can’t recover their accounts. I need it to just enter their username and give you a new password.

Me: We can’t do that I’m afraid, it would allow any user to get into any account which would be a massive security failing.

Customer: Well, Amazon let me enter my username and send it to an email of my choice.

Me: They will only let it send to an email already on file, otherwise that would be incredibly insecure and let anyone get your password.

Customer: No I just enter my username and they send a new password to whatever email I specify.

Me: I can absolutely guarantee that this is not the case, you have to enter your username and the matching email.

Customer: This is a terrible system.

Me: I’m sorry to hear that you feel that way. Is there anything else I can help with?

Customer: *long drawn out sigh* “No, I suppose not.” *hangs up*