I have an application that sends username and a password by email (random temporary password, mandatory change on first login).
A big customer has this policy of "never send username and password in the same message" - and they are demanding a change in order to split it in two email messages, one containing the username and other with the password.
I would understand if the demand was to send information using distinct channels, lets say, send the username by email and password by SMS, because compromising both channels is harder. But sending the information splitted in two messages over the same channel makes no sense for me: if you think your email can be compromised, you must assume the attacker will be able to read both messages, so what is the fracking point?
Is there any logic behind this policy?