22

Our web app allows our customers to invite their collaborators into their account. They can submit the new user's email address, and our app sends the new user an email inviting them to login. Once logged in, the new user can view and edit our customer's data.

How should we invite these new users to authenticate? Some options...

  • A temporary password (ex: Login at myapp.com! Your password is 'bobcat5123')
  • A link to a special one-time login url (ex: Login at myapp.com/login?token=fx4c23n89x)
  • Other ideas?

I prefer the one-time login, but I'd like to hear your reasoning :)

Improve this question
1

2 Answers 2

Reset to default
30

It's better to use a special one-time login url.

Reasoning: You want to make the process as easy as possible to have the lowest drop-off rate. Sending someone a temporary password requires them to either retype a password that they haven't chosen, or copy and paste it. It also provides no additional security benefits.

Improve this answer
3
  • 1
    "...also provides no additional security benefits...", correct, assuming that the temp password is required to be reset as soon as the user logs in. Using the one-time login URL kind of forces you to do that.
    – Joseph Szymborski
    Apr 1, 2013 at 5:08
  • @JosephSzymborski Even if that weren't the case, emailing a password would still provide no security benefits.
    – JohnGB ♦
    Apr 1, 2013 at 8:21
  • 4
    I would like to add that for security reasons, you should limit the amount of time that this url is active. You might want to allow up to a day between sending it and the activation to occur.
    – Omer van Kloeten
    Apr 1, 2013 at 20:34
1

You can do a combination of both: Login url which takes them to a pre-populated form with their username and temporary password.

You basically send them their confirmation(?) email and mention their temporary (not one time) password and username and the URL (which has the username and password appended with encryption).

Improve this answer
7
  • 1
    No. Never send a password in email, never pre-populate passwords in forms. This is a huge security no-no.
    – Omer van Kloeten
    Apr 1, 2013 at 20:32
  • I get it that it is a security issue. Can you explain how it is more problematic than sending the one time URL?
    – rk.
    Apr 1, 2013 at 20:35
  • The user's password should never be recoverable by the site. It should also never appear in writing in any medium. We have explained more here: plaintextoffenders.com/about.
    – Omer van Kloeten
    Apr 1, 2013 at 20:36
  • The link is about storing passwords in plain text. You cannot 'recover' this password since it's one time use only. Also, what is preventing a person who is gaining access to the email with the password written in it compared to the one time login url?
    – rk.
    Apr 1, 2013 at 20:39
  • 1
    There are two ways to pre-populate the form: Either you send them their link with the password in the link (never send passwords in GET requests) or that the password is pre-populated on the server, in which case the server can know what the password is. As I mentioned in my comment to @JohnGB's answer, the url is one time, time-limited and requires that the user enter their own password upon using.
    – Omer van Kloeten
    Apr 2, 2013 at 6:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.