Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I understand it's not safe to send passwords via email but when accounts are created via WHM/Cpanel, I have to let the user know what password I created for them. How can I relay the password safely?

share|improve this question

1 Answer

up vote 2 down vote accepted

Don't transmit a password at all. Set the password to something completely random, then automate a password reset. This will create a one-time link that allows them to log in, and forces them to change the password immediately.

Benefits of this scheme:

  • A valid password is never sent in cleartext.
  • The one-time link is useless after one use, so an attacker stealing the link later isn't a problem.
  • The user is prompted to create a password immediately, so the account is secure the instant they start to use it.
  • You know when a user has logged in successfully for the furst time, which allows you to send them an email thanking them for their custom. Furthermore, you could send out an email to any unactivated account after 12 hours or so, reminding them to use the link to set up their password.
share|improve this answer
I'm assuming the difference between sending an expire-on-login password and a one-time-link is that the link can be used only once, and would have to be re-requested, whereas the user might decline to create a new password (forgoing the ability to use the site, but leaving the password eligible). Or have I missed something here? – Clockwork-Muse Aug 3 '12 at 20:46
Pretty much, yeah. The point is that once the link is used, it's used, and the user has set their own password. With a one-time password, you are transmitting a token that is usable for more than one login. – Polynomial Aug 4 '12 at 8:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.