Looking for best practices on password recovery

Inevitably, when we discuss “loosely coupled” approaches with educational institutions, the conversation inevitably turns to “security and authentication” issues. But really, often what is meant is “those nasty web 2.0 tools won’t single sign-on to my [monolithic, obscure] campus login system, so what are we to do?”

The last time I was in this conversation, Brian Lamb made the simple but inspired observation that a hu...