You could also consider askingAsk your users to do a first time authentication through an OpenID provider (or less secure or Oauth) provider, such as Google, Microsoft, Amazon etc., to verify their identity and negate the insecirity. This avoids any security concerns of emailemailing a password to the user.