LOVEFILM forgotten password antipattern

If you really want to annoy someone on LOVEFILM, enter their email address in the "Forgotten Password" screen.

Here's what happens:

  1. LOVEFILM immediately changes the user's password
  2. LOVEFILM emails the user with a new, random password and asks them to log in with that new password.

If you're the poor sap at the receiving end of this prank, you have to:

  1. Log in with your new password
  2. Go to your account and change your password

They've got this whole "forgotten password" pattern all wrong.

Here's how it should work:

LOVEFILM should send you a temporary password (e.g. valid for an hour) that you can log in with but it shouldn't disable/change your current password. That way, if someone else requested the change (either by mistake or to annoy you), you can simply ignore the email.

The way it's implemented today, LOVEFILM actually allows a random stranger to make a change to your account (change your password) and causes you to take steps to remedy that action.

If someone wanted to really piss you off, they could reset your password daily.

I only stumbled upon this because I thought I had forgotten my password and requested a new one. Then, before the email arrived, I remembered my password. But it was too late. LOVEFILM had changed my password the moment I'd entered my email address in (and so I had to wait for the email to arrive before I could login to my account).

Of course, they could also side-step all this and implement support for OpenID. That would really rock!