In a system I'm developing, we send out a password(?) to a user. They can request a new password - sent via email, but they can never set it themselves.
Is there a good word for this type of thing? Passcode maybe?
3
-
whats the context – Mervin May 17 '15 at 3:54
-
They enter in the code to allow them to reserve tools from a shop. – kylex May 17 '15 at 4:00
-
Don't send passwords via email. That's wrong. Period. Emails are not a secure communication channel as it's not encrypted end-to-end. If you can't send the initial password via a third-party channel (e.g. in person at registration booth or via SMS assuming that you trust their phone service provider and all the intermediaries), you're better off letting users set it -- and possibly providing a service that creates new, random passwords on the client-side that users can decide to write down in their method of choice (hopefully, though probably not, a password manager) and use in the future. – Steve Dodier-Lazaro May 18 '15 at 23:39
Add a comment
|
Token is a good term for it. This is what OWASP (the open web application security project) refers to it as.
You may want to look at the owasp guidelines for forgotten password - https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet
It is very deliberately not called password as you should never send a password via email. Tokens are usually used to validate a side channel, i.e. that you have access to the email account.
Passwords should only ever be known by the user. A system should never know it, apart from the very short, transient process of taking it from a user and transforming it into a digest (either to store on a change of password, or to compare for authentication).
After reading what you want to use if for - you may want to just call it a code. Or ask your users what makes sense to them. Token may be a bit confusing to an end user. Shopping code / item code / offer code / code / ticket may be a bit more friendly?
I think the term you are looking for is "Verification code"
Here are some examples
There are several terms used for this:
- Token (or verification token)
- One-time password (or OTP)
- Temporary password
- Verification code
- Validation code
They are loosely interchangeable.
In your case, if the system sets the password and it's persistent (Ie the user doesn't change it except to request another system-assigned password) then it's probably just a password or an assigned password.
