Do you have any examples of someone further explaining what you are suggesting? Or if you have time, can you further elaborate on this point? I glanced at the nounce article on wikipedia and if I understand correctly you are suggesting:
1) user creates account (which generates nounce)
2) when password resetting via email auth via nounce.
3) when password is reset regen nounce
Is that right? Just trying to better understand what appears to be a good approach to password resets.
That's basically right. Generally you generate the nonce when someone clicks the 'forgot password' link, but I suppose you could do it when someone creates the account as well.
1) user creates account (which generates nounce)
2) when password resetting via email auth via nounce.
3) when password is reset regen nounce
Is that right? Just trying to better understand what appears to be a good approach to password resets.