Timeline for What's the safest way to inform a new user of their password on an invite-only website?
Current License: CC BY-SA 4.0
27 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 26, 2019 at 21:56 | comment | added | eckes | @MikeScott you can have the hr enroll employees and give them their badge/smartcard. But for e-commerce public communication channels are the trust anchor you have to deal with (often you don’t care who it is as long as it’s the same login every time) | |
| Jun 26, 2019 at 16:42 | comment | added | eckes | @Sentinel no it’s not b/s email is very weak and there are many alternatives, however in most scenarios email is the only viable trust model | |
| Jun 26, 2019 at 16:41 | comment | added | eckes | @marstato well fist of all this would probably be much safer then having „password“ as password but I am talking about a initial password which has to be changed on first login. | |
| Jun 26, 2019 at 15:52 | comment | added | Mike Scott | Do you want the actual safest way, or the safest way that’s reasonably practical and convenient? For example, if your CTO personally visits each user to tell them their password face-to-face, that’s very safe but very impractical. | |
| Jun 26, 2019 at 15:38 | comment | added | marstato | @eckes I disagree. Yes, email is the common weakest link. But there are people just pasting the initial password into some random unencrypted file on their harddrive because the generated initial password appears safer to them than anything they would come up with | |
| Jun 26, 2019 at 15:14 | comment | added | RonJohn | The safest method is personal contact. | |
| Jun 26, 2019 at 13:31 | history | protected | Rory Alsop♦ | ||
| Jun 26, 2019 at 9:55 | answer | added | SQB | timeline score: 2 | |
| Jun 26, 2019 at 9:15 | comment | added | ave | Not the same thing, but what we do on our site that is between invite only and public is: user registers with username, password and email, we manually approve user's account (or delete it), user gets an email to verify their email, and when they verify their email, they can immediately access their account with the password they set. | |
| Jun 26, 2019 at 4:43 | comment | added | Sentinel | Why have a password at all. Why not use passwordless logins using emailed time limited one time links. | |
| Jun 25, 2019 at 22:01 | answer | added | Fabby | timeline score: 1 | |
| Jun 25, 2019 at 18:17 | answer | added | bobuhito | timeline score: 0 | |
| Jun 25, 2019 at 13:19 | history | edited | Luc | CC BY-SA 4.0 |
edited title
|
| Jun 24, 2019 at 16:01 | vote | accept | Avrohom Yisroel | ||
| Jun 24, 2019 at 14:31 | answer | added | Steve Gazzo | timeline score: 0 | |
| Jun 24, 2019 at 14:17 | answer | added | TJK | timeline score: 3 | |
| Jun 24, 2019 at 10:27 | answer | added | Cyberduck | timeline score: 1 | |
| Jun 24, 2019 at 9:41 | comment | added | eckes | BTW there is no difference in sending a one-time-Link or a one-time-initial-password by mail, whatever is easier to implement. Both will rely on email security which is weak but a common trust model. So unless you don’t have alternate contact information or a encryption key of the users you have to go with that. Make sure they can alert you if they find the one-time-thing not working (because someone else used it) | |
| Jun 24, 2019 at 9:00 | history | tweeted | twitter.com/StackSecurity/status/1143081340109295622 | ||
| Jun 24, 2019 at 7:51 | answer | added | user3399 | timeline score: 7 | |
| Jun 24, 2019 at 6:46 | history | became hot network question | |||
| S Jun 24, 2019 at 5:44 | history | edited | Tobi Nary | CC BY-SA 4.0 |
Removed useless information, removed open question
|
| S Jun 24, 2019 at 5:44 | history | suggested | Samuel Philipp | CC BY-SA 4.0 |
Removed useless information
|
| Jun 23, 2019 at 23:50 | answer | added | Samuel Philipp | timeline score: 52 | |
| Jun 23, 2019 at 23:36 | review | Suggested edits | |||
| S Jun 24, 2019 at 5:44 | |||||
| Jun 23, 2019 at 22:42 | answer | added | David Waters | timeline score: 207 | |
| Jun 23, 2019 at 22:31 | history | asked | Avrohom Yisroel | CC BY-SA 4.0 |