(Please read the update at the end)
I am trying to find out how to send user registration emails securely. I read answers on this question:
I don't intend to send passwords in emails, but I was considering something similar to this answer (temporary links).
However, I keep asking myself the same question someone asked in comments to that answer: "So what's stopping the link in the email from being hijacked by a middle-man who uses the link to reset the user's password?"
UPDATE: Sorry, I wrote this in a haste (I need something done "yesterday"). I am basically concerned with email hijacking in general. What actually happens is this:
- Someone creates a Tenant (an organization) account. This is standard registration and I am doing it with a temporary link that is sent to the user.
- Admin user is created in the first step.
- Admin user later creates other accounts. This part is where I am concerned about email hijacking.
I could send a temporary password to the new user. I also considered 'invitation' email, where the new user would get a temporary link where they could insert their password (the link would be deleted after that).
I am not happy with either solution, because I feel like someone could hijack the email and either read the temporary password or use the temporary link to insert their own password before the user does.
I hope this makes my question more clear. If not, please tell me and I'll try to improve it.