I'm implementing a system where our users need to enter a special (permanent) password to authorise a transaction.
The password is separate to their login credentials, and they can only enter this auth password if they're logged in.
We want the server to generate and send the password to them by email, and we'll store a hash of the password on the server. At the user's request we will be able to refresh this password.
I've looked at other questions, such as Is sending password to user email secure?, and it seems that the issue isn't with sending passwords, but storing plaintext passwords.
Is there anything I should be concerned about with this process?