Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

Our web app allows our customers to invite their collaborators into their account. They can submit the new user's email address, and our app sends the new user an email inviting them to login. Once logged in, the new user can view and edit our customer's data.

How should we invite these new users to authenticate? Some options...

  • A temporary password (ex: Login at myapp.com! Your password is 'bobcat5123')
  • A link to a special one-time login url (ex: Login at myapp.com/login?token=fx4c23n89x)
  • Other ideas?

I prefer the one-time login, but I'd like to hear your reasoning :)

share|improve this question
1  
Never send passwords in an email. You shouldn't even be able to know what the users' passwords are. See plaintextoffenders.com/about for more. –  Omer van Kloeten Apr 1 '13 at 20:33
add comment

2 Answers

up vote 31 down vote accepted

It's better to use a special one-time login url.

Reasoning: You want to make the process as easy as possible to have the lowest drop-off rate. Sending someone a temporary password requires them to either retype a password that they haven't chosen, or copy and paste it. It also provides no additional security benefits.

share|improve this answer
1  
"...also provides no additional security benefits...", correct, assuming that the temp password is required to be reset as soon as the user logs in. Using the one-time login URL kind of forces you to do that. –  Joseph Szymborski Apr 1 '13 at 5:08
    
@JosephSzymborski Even if that weren't the case, emailing a password would still provide no security benefits. –  JohnGB Apr 1 '13 at 8:21
4  
I would like to add that for security reasons, you should limit the amount of time that this url is active. You might want to allow up to a day between sending it and the activation to occur. –  Omer van Kloeten Apr 1 '13 at 20:34
add comment

You can do a combination of both: Login url which takes them to a pre-populated form with their username and temporary password.

You basically send them their confirmation(?) email and mention their temporary (not one time) password and username and the URL (which has the username and password appended with encryption).

share|improve this answer
1  
No. Never send a password in email, never pre-populate passwords in forms. This is a huge security no-no. –  Omer van Kloeten Apr 1 '13 at 20:32
    
I get it that it is a security issue. Can you explain how it is more problematic than sending the one time URL? –  rk. Apr 1 '13 at 20:35
    
The user's password should never be recoverable by the site. It should also never appear in writing in any medium. We have explained more here: plaintextoffenders.com/about. –  Omer van Kloeten Apr 1 '13 at 20:36
    
The link is about storing passwords in plain text. You cannot 'recover' this password since it's one time use only. Also, what is preventing a person who is gaining access to the email with the password written in it compared to the one time login url? –  rk. Apr 1 '13 at 20:39
1  
There are two ways to pre-populate the form: Either you send them their link with the password in the link (never send passwords in GET requests) or that the password is pre-populated on the server, in which case the server can know what the password is. As I mentioned in my comment to @JohnGB's answer, the url is one time, time-limited and requires that the user enter their own password upon using. –  Omer van Kloeten Apr 2 '13 at 6:57
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.