My company deals with a outside company for 401k. We just noticed a security hole in the password reset process on their company site.There is no second layer of authentication to verify the user such as a security question to reset the password (it clearly exposes the current password by clicking on a redirected link once you retrieve the email from your account). If the email is forwarded or someone has access to my account my account is now open to compromise with this method. I am looking for some official documentation to prove my point. Any suggestions?