>Not secure. It's all sent in plain text.
>
>>Btw, I just checked this site (UT) which - if you forget the password - resets your password to a random one and emails it to you, along with your user ID.

That's actually OK as long as you make the user change their password as soon as they log in. Then the token approach and emailing you a temporary password are equivalent. Having said that, I think the token approach is actually easier to implement.

When they click the reset password link, generate a token and expiration date/time and store it into their account. E-mail the user a link that contains this token. Then create a page that can receive this token, verify the token and make sure it hasn't expired and display a field to change the password. On save, update the password hash and clear the token/expiration. Maybe also log the last password reset date/time.