I think a lot of people do this for infrequently visited sites, but:
1. It generates at least 3 new database transactions each time it happens, not to mention the associated crypto requirements and email.
2. This password recovery system is a common attack vector and vulnerable to social engineering attacks and MITM attacks.
3. It is mostly obviated by the existence of password managers. For those with the knowhow to do this sort of thing, all of this sort of stuff should be happening on the client side.
1. It generates at least 3 new database transactions each time it happens, not to mention the associated crypto requirements and email.
2. This password recovery system is a common attack vector and vulnerable to social engineering attacks and MITM attacks.
3. It is mostly obviated by the existence of password managers. For those with the knowhow to do this sort of thing, all of this sort of stuff should be happening on the client side.