2

I created a small website where participants can sign up with some data (name, email, birthdate, ...) but they don't have to set username and password.

After a while it would be useful to provide some kind of overview site (of course not showing any personal data) for each user. Now I'm thinking about different ways how to achieve that:

  1. Sending each User a personal URL (e.g. mydomain.com/LongAndUniqueRandomString) without login.

    • PRO: less overhead, less security issues
    • CON: public to everyone else who has the URL, bad email practice as it behaves like phishing spam

  2. Implementing a login and send each User his personal (predefined) Password

    • PRO: better privacy
    • CON: no save way to provide password to the user

What do you think?

Improve this question
5
  • 1
    "Implementing a login and send each User his personal (predefined) Password" Do you mean, you generate the password for them and send them? Why would you do this instead of letting them write their own password?
    – Kepotx
    Commented Mar 18, 2019 at 12:48
  • How can I provide a site for letting the users set their own passwords, if the accounts (incl. username) already exist?
    – RandomRouter
    Commented Mar 18, 2019 at 13:06
  • Currently, how can the users access their accounts?
    – Kepotx
    Commented Mar 18, 2019 at 13:14
  • @RandomRouter Usually, the entire point of implementing user specific logins would be because there is some kind of sensitive/personalized information for each user. If those users already have accounts, why don't they have passwords already?
    – Tipping44
    Commented Mar 18, 2019 at 13:21
  • The users signed up with some general information (name, email, birthdate, etc.) to get some kind of personalized document after registration. But they are not able to edit their provided data yet. At least editing personal data isn't required but some kind of personal overview to show up some statistics.
    – RandomRouter
    Commented Mar 18, 2019 at 13:39

2 Answers 2

Reset to default
2

The traditional method of allowing users to enter a username and password works, changing it for a substitute of you creating their password or, worse yet, eliminating it completely seems a little odd.

I'd recommend sticking to the traditional way, however, in the interest of the question;

Sending them a unique URL

This has so many follow up questions, but on the assumption they sign up and you send them a url to access their "data"? There isn't a safe security practice behind this, you've said it yourself, if someone else obtains that URL, you have a compromised user. Stick to the tried and tested method of correctly implementing sessions into your website. Along with minimizing security breaches, you also then won't need to worry about hosting X amount of separate web pages for every single user.

Sending user a password

I don't see any reasoning behind why you'd want to do this, letting a user set up their own password is no additional effort to you at all. Sending them a password runs the risk of emails being compromised.

What happens if an email that's meant for "Jake" is compromised by "John". I don't think Jake would be all that forgiving because you insisted on creating, and sending a password to him.

If you do insist on using these types of methods, be very, very careful with regards to what information you store and what kind of information users can access.

Improve this answer
0

Login/Sign Up with personal details which could be known to others/friends/relatives also. Hence the account will automatically get compromised with social engineering attack. You can give user default password which would be common for everyone and then a user will set his/her own password for login.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .