Here's a scenario that I often encounter:
- Some user needs access to something on my network, but they don't have an existing account in AD.
- I create an AD account for them which I then use to allow access to an SSL VPN or an SFTP account or whatever.
I typically send an email with detailed connection instructions and text them a password. I often use a free service provided by Norton to generate a random password with >= 8 chars.
Without knowing what algorithm Norton uses to generate these random char strings, the question is, is this secure? The site I'm using to generate the passwords is SSL and I'm texting the password to the user, thereby separating the instructions (via email) from the required password.
How could I approach this problem differently in order to make the process more secure without having the ability to have the end user set their own password?