Timeline for Is it good idea to send user password upon register?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 14, 2014 at 10:09 | comment | added | AlexC | This is a really good and interesting idea. It's like the way sites with two-factor authentication will say "We've just sent a text message to your mobile phone number xxxxx xxxxxx34". First two and last two characters will usually be enough to prompt recall of the password, and not enough to allow an interceptor to figure it out. I like it a lot. | |
| May 12, 2014 at 13:16 | comment | added | Tom | From an UX standpoint, i think it doesn't really matter which part of the password is returned, as long as it helps you remember what it is. It could theoretically be a security issue, but only if you a) use the same password for everything, b) all the revealed characters contain a large part of the entire password and c) somebody has access to your inbox. If you do not like users getting their partial password back immediately, just store the first and last characters in an encrypted or obfuscated way for future reference. This should strike a balance between UX and safety. | |
| May 12, 2014 at 7:05 | comment | added | Justin |
I can think of only one problem: what if different organizations reveal different characters? You might have one that shows O***!, another that is OMG*** or 420!!! or all sorts of different variations. However, this is a much better idea than sending the whole password, although I'd rather not be told what my password is because I just typed it in before I got the email.
|
|
| May 9, 2014 at 12:02 | review | First posts | |||
| May 9, 2014 at 12:48 | |||||
| May 9, 2014 at 11:44 | history | answered | Tom | CC BY-SA 3.0 |