Skip to main content
Information Security

Return to Answer

Added infos
Source Link
Cyberduck
Cyberduck
  • 674
  • 4
  • 18

From my point of view E-Mails is a common used communication channel. It's generally considered as secure which might be true if everyone will set things right up like using SSL/TLS connections for POP3/IMAP or SMTP. In reality not all people know what these techniques are good for and just move forward with no transport security and so the misconfigure their system. So how to overcome this problem?

I would say there will be a safer way to provide an account to your customer. Think about your phone. No need to set it up and it works. So there won't be the problem of misconfiguration. So let's think about it a bit. I know SMS Token and calls are also not that safe, but it's a bit harder to get a SMS from another telephone redirected to the hackers phone. So why not using the phone number to send them a one time password which they use on a setup page and finish their registration? I would say this will be more secure then using e-mails.

Anyway if you want to use E-Mails i would not set the password for the user and send it to them. And I got some reasons to think about why you shouldn't do it that way and let them set the password on their own:

  • If you send a password some users might think you store them unhashed and you can see it so they won't trust you, even if it's not true.
  • Some users aren't changing the password and leave it like the sent one.
  • If the customer leave the password the original one and someone has access to the others E-Mail account or the senders E-Mails, he got his password.

For that reasons I would just send a link where they can create a password on their own.

From my point of view E-Mails is a common used communication channel. It's generally considered as secure which might be true if everyone will set things right up like using SSL/TLS connections for POP3/IMAP or SMTP. In reality not all people know what these techniques are good for and just move forward with no transport security and so the misconfigure their system. So how to overcome this problem?

I would say there will be a safer way to provide an account to your customer. Think about your phone. No need to set it up and it works. So there won't be the problem of misconfiguration. So let's think about it a bit. I know SMS Token and calls are also not that safe, but it's a bit harder to get a SMS from another telephone redirected to the hackers phone. So why not using the phone number to send them a one time password which they use on a setup page and finish their registration? I would say this will be more secure then using e-mails.

From my point of view E-Mails is a common used communication channel. It's generally considered as secure which might be true if everyone will set things right up like using SSL/TLS connections for POP3/IMAP or SMTP. In reality not all people know what these techniques are good for and just move forward with no transport security and so the misconfigure their system. So how to overcome this problem?

I would say there will be a safer way to provide an account to your customer. Think about your phone. No need to set it up and it works. So there won't be the problem of misconfiguration. So let's think about it a bit. I know SMS Token and calls are also not that safe, but it's a bit harder to get a SMS from another telephone redirected to the hackers phone. So why not using the phone number to send them a one time password which they use on a setup page and finish their registration? I would say this will be more secure then using e-mails.

Anyway if you want to use E-Mails i would not set the password for the user and send it to them. And I got some reasons to think about why you shouldn't do it that way and let them set the password on their own:

  • If you send a password some users might think you store them unhashed and you can see it so they won't trust you, even if it's not true.
  • Some users aren't changing the password and leave it like the sent one.
  • If the customer leave the password the original one and someone has access to the others E-Mail account or the senders E-Mails, he got his password.

For that reasons I would just send a link where they can create a password on their own.

Source Link
Cyberduck
Cyberduck
  • 674
  • 4
  • 18

From my point of view E-Mails is a common used communication channel. It's generally considered as secure which might be true if everyone will set things right up like using SSL/TLS connections for POP3/IMAP or SMTP. In reality not all people know what these techniques are good for and just move forward with no transport security and so the misconfigure their system. So how to overcome this problem?

I would say there will be a safer way to provide an account to your customer. Think about your phone. No need to set it up and it works. So there won't be the problem of misconfiguration. So let's think about it a bit. I know SMS Token and calls are also not that safe, but it's a bit harder to get a SMS from another telephone redirected to the hackers phone. So why not using the phone number to send them a one time password which they use on a setup page and finish their registration? I would say this will be more secure then using e-mails.