After users have registered on a website, should that website send both username and password in their registration confirmation email ?
A system should not store the user's password in retrievable mode. This could be done adding salt (a meaningless string of letters and numbers, which doesn't change) and then hashing the whole string before saving to a persistent storage.
When the user signs into the system, the same route is taken to make sure that the password is correct. (password + salt) + hash = stored string.
Now this means that the system does not know the password, and therefore cannot send it to the user. Instead the user can receive a confirmation email where the user validates her email address. If the password is lost, we shouldn't send the password to the user. We should send a link to a unique page, valid only once, where the user can change the password, if the password were forgotten and requested by the user.
Please don't send passwords in email. Username is ok to send, though.
|show 4 more comments|
From a user experience point of view I would say it is nice to get your nickname confirmed in a registration email, but sending the password along might create the impression of lax security.
A user will never require to get their password emailed, if you set up a password reset mechanism that only sends password reset links to an user's email (in case they have forgotten their password). It requires more clicks, but users are becoming more and more tech-savy and know to appreciate improved security as part of their usage experience of your service.