Timeline for What's the safest way to inform a new user of their password on an invite-only website?
Current License: CC BY-SA 4.0
3 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Jun 27, 2019 at 15:55 | comment | added | Steve Gazzo | A hard to guess token is hard to guess, but a time limit also means a compromised token can't be used. A really-long, hard to guess token that is compromised is still a security issue. I should've been more clean about the compromise scenario in my answer, though. | |
Jun 26, 2019 at 9:04 | comment | added | ave | "This will prevent the situation where users who do not set their password can have their token guessed and their account hijacked." so use a long, long token. putting a time limit doesn't really add any security value IMO. | |
Jun 24, 2019 at 14:31 | history | answered | Steve Gazzo | CC BY-SA 4.0 |