Timeline for What's the safest way to inform a new user of their password on an invite-only website?
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 25, 2019 at 0:33 | comment | added | Frank Hopkins | @P.Goetterup so whether it's necessary really depends on the security requirements. That it wasn't in your case, doesn't imply it isn't in all other cases. Though, granted, the question from OP - and the fact that he needs to ask here - make it likely (hopefully^^), that OP's system has not that high a security requirement. | |
| Jun 25, 2019 at 0:31 | comment | added | Frank Hopkins | @P.Goetterup The time limit prevents malicious access in cases the original user ignores the mail and "forgets" about it, but at some point an intruder gains access to his mail account where he find's the mail and can still use the reset-link. With a time limit this expansion of the intruder's access is not possible. Granted it might not be much of an issue, but in some cases it can be all the difference between a simple loss of some old communication of an ex-employee and a breach to the main customer database, financial management tool etc. pp. | |
| Jun 25, 2019 at 0:28 | comment | added | Frank Hopkins | @Marc.2377 If the system requires regular changes of passwords anyway, it's the same process as a regular password change after X amount of time, and in that case it's a procedure a user already knows. I'd prefer that slightly over some new process from a UX perspective and strongly from a technical perspective for being able to reuse much of the existing process/code. But if such a process is not present, I'd be with you. | |
| Jun 24, 2019 at 17:31 | comment | added | Marc.2377 | From an UX perspective, I believe this solution to be worse. If I'm going to be required to change the password after first login, what's the point? Just let me set a password directly, instead of having to copy-paste (or type) a temporary password and then setting a new one. (Whenever that is possible). | |
| Jun 24, 2019 at 11:04 | comment | added | P. Goetterup | If you send the new user a link with a long randomized token that can be opened only once, a time limit is not really necessary. I created such a system for a large hosting company I worked for a few years ago and it was integrated into their support system so a new password could be generated, the token generated and the email with the URL generated and sent at the press of a button. | |
| Jun 24, 2019 at 7:55 | review | First posts | |||
| Jun 24, 2019 at 11:39 | |||||
| Jun 24, 2019 at 7:51 | history | answered | user3399 | CC BY-SA 4.0 |