Skip to main content
Tweeted twitter.com/#!/StackUX/status/464018633010601985
added 338 characters in body
Source Link
Pavel Janicek
  • 1.6k
  • 2
  • 11
  • 12

I can imagine both ways - send / not send and still make it secure enough inside application.

For instance: I get the password from "Enter your password" field, store it in email template and then save it securely (only its hash) in database

  Hi, <username>
  We just registred you at our super awesome page.
  Your password is <entered password during register>
  Yada yada blah blah blah

But having second thought about it, I know for sure, that experienced users know that if a site sends you password in plain text, that site has definitely some security issue (= if you hack database, you will see users and their passwords)

  Hi, <username>
  We just registred you at our super awesome page.
  We saved your password in super safe way, so we can only reset it at any given time
  Yada yada blah blah blah 

I would like to hear some insights on which one is better from user perspective.

EDIT After third answer in style "do not store password plaintext" I want to make something clear:

  • I woud FIRST send e-mail and THEN hash the password in database in secure way. There is no way I would store passwords in DB unencrypted (unsecure). This is really only about if I should send the password back to user or not.

I can imagine both ways - send / not send and still make it secure enough inside application.

For instance: I get the password from "Enter your password" field, store it in email template and then save it securely (only its hash) in database

  Hi, <username>
  We just registred you at our super awesome page.
  Your password is <entered password during register>
  Yada yada blah blah blah

But having second thought about it, I know for sure, that experienced users know that if a site sends you password in plain text, that site has definitely some security issue (= if you hack database, you will see users and their passwords)

  Hi, <username>
  We just registred you at our super awesome page.
  We saved your password in super safe way, so we can only reset it at any given time
  Yada yada blah blah blah 

I would like to hear some insights on which one is better from user perspective.

I can imagine both ways - send / not send and still make it secure enough inside application.

For instance: I get the password from "Enter your password" field, store it in email template and then save it securely (only its hash) in database

  Hi, <username>
  We just registred you at our super awesome page.
  Your password is <entered password during register>
  Yada yada blah blah blah

But having second thought about it, I know for sure, that experienced users know that if a site sends you password in plain text, that site has definitely some security issue (= if you hack database, you will see users and their passwords)

  Hi, <username>
  We just registred you at our super awesome page.
  We saved your password in super safe way, so we can only reset it at any given time
  Yada yada blah blah blah 

I would like to hear some insights on which one is better from user perspective.

EDIT After third answer in style "do not store password plaintext" I want to make something clear:

  • I woud FIRST send e-mail and THEN hash the password in database in secure way. There is no way I would store passwords in DB unencrypted (unsecure). This is really only about if I should send the password back to user or not.
Source Link
Pavel Janicek
  • 1.6k
  • 2
  • 11
  • 12

Is it good idea to send user password upon register?

I can imagine both ways - send / not send and still make it secure enough inside application.

For instance: I get the password from "Enter your password" field, store it in email template and then save it securely (only its hash) in database

  Hi, <username>
  We just registred you at our super awesome page.
  Your password is <entered password during register>
  Yada yada blah blah blah

But having second thought about it, I know for sure, that experienced users know that if a site sends you password in plain text, that site has definitely some security issue (= if you hack database, you will see users and their passwords)

  Hi, <username>
  We just registred you at our super awesome page.
  We saved your password in super safe way, so we can only reset it at any given time
  Yada yada blah blah blah 

I would like to hear some insights on which one is better from user perspective.