All,I'm developing a small, non-commercial web app.  I'm trying to decide how to help a user who might have lost their password.  I need a mechanism that is, in order of priority:1) User friendly;2) Secure;3) Easily scalable across multiple geographies (i.e., location agnostic - so no SMS for example).  
What are recommended password reset mecanisms?
security;authentication;password
An alternative approach:Have the user provide the email address they used when they registeredVerify that email address does indeed belong to an account (report an error if it does not)Send an email to that email address with... ...a new password that is auto-generated (dictionary words are better than random characters) and expires after a set period of time (let's say 24 hours)...a message that this new password was sent as a request from your website and if they didn't request it to ignore that email...the URL they need to visit to re-login with their new password (make sure this page validates against the temporary password and not their actual password)After their initial login, take them to a page where they are required to update their password to one they will remember (you can't show them their actual password because you hashed it, right?)