I am writing an app that requires multiple levels of users, where one user is an administrator and adds slave users.
I can't really seem to find a way to allow access to the slave users safely. Emailing a password is unsafe as emails are unencrypted, and I might as well just send the password if I'm sending a one-time link.
I can reduce the window exponentially by making a temporary password required to be changed on first login, emailing a one-time use link, setting a timeout on either of these, or any combination of all of these...
But the window still seems extremely large compared to asynchronous encryption, for example.
I could require an SSH communication or something, but obviously this is not even close to pragmatic.
What is the industry standard, and what solution, if any, can provide both a pragmatic user-friendly experience, as well as a secure channel?