Timeline for Is it good idea to send user password upon register?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 9, 2014 at 18:21 | comment | added | Robert | From a user experience standpoint, though, that's pretty rough. You're basically saying "here's a gibberish one-off password, please copy it and login with it and then change to another password" whereas the link -> password/confirm password flow is a bit easier on the user. Whether they have this gibberish password or the link (especially if the username is the user's email address), it really won't matter security wise. Perhaps where there are usernames that are not email it may help, but where the email address is the username, won't change anything except more actions required. | |
| May 9, 2014 at 16:01 | comment | added | Phil Perry | If a user forgets their password and requests a "refresh", it is common to email them a one-time-only password that they must immediately change. Of course, someone could intercept that email and do some damage before another password can be issued. Doing it on an on-site SSL web page might be reasonably secure, but even then, if the email giving the session key (the only proof of who is using it) is intercepted, someone else could use that link before the intended user can. I'm not sure there is any foolproof way to do this over the network, that a determined bad guy couldn't steal. | |
| May 7, 2014 at 16:29 | review | First posts | |||
| May 7, 2014 at 16:30 | |||||
| May 7, 2014 at 16:09 | history | answered | Andrew Leader | CC BY-SA 3.0 |