5 ms·

Can you please define the pain that you're solving with a little more granularity? Is the issue the friction of getting the password to the user, or is it a se

by Travis 17y ago

Can you please define the pain that you're solving with a little more granularity? Is the issue the friction of getting the password to the user, or is it a security thing? If it's a security issue, there's still the problem of key distribution (rather, PIN distribution). When I look at this quickly, I think, "hmm, email solves the distribution concern. And this isn't really a secure solution, so it doesn't solve the security concern." So what are you solving?

harisenbon 17y ago
The pain is the inability to quickly and easily send passwords to users. Faxes used to be the original way to send passwords, but now many places no longer have fax machines, and giving passwords over the phone leads to mistakes and it is often hard for users to recognize long passwords with upper/lowercase as well as punctuation. The main reason that sending passwords through email is insecure is that : a) the password stays in the mailbox of the user, and can be read at a later time b) if the mail is intercepted by a hacker, the user will never realize that the mail has been read, and the hacker has access to the username/password SendMyPassword.net produces a link that is safe to send to your end user over email. a) The link can only be used once, so the user can be sure that the password was not intercepted b) The link will expire after a certain amount of time, so that even if the user does not view the password, no one can come by later and retrieve the password. c) The entire site is SSL secure, and all passwords/links/etc are encrypted, as security was our main goal. I'm curious: How do you mean that this is not a secure solution?
- Travis 17y ago
  Fair enough, I was just curious exactly how you saw the issue. My concern on security is how do you transmit the PIN used to view the password? Unless I'm misunderstanding, and it's something more akin to pushing a password to another user's account. I think your product does a good job, I'm just not sure if the pain is sufficient to overcome the additional complexity of requiring yet another transaction to a third party. What advantage does this offer over a tokenized link that allows you to set your password? It could also expire on opening/set time, which would address the email/security issues above.

by Travis 17y ago

harisenbon 17y ago

The pain is the inability to quickly and easily send passwords to users. Faxes used to be the original way to send passwords, but now many places no longer have fax machines, and giving passwords over the phone leads to mistakes and it is often hard for users to recognize long passwords with upper/lowercase as well as punctuation. The main reason that sending passwords through email is insecure is that : a) the password stays in the mailbox of the user, and can be read at a later time b) if the mail is intercepted by a hacker, the user will never realize that the mail has been read, and the hacker has access to the username/password SendMyPassword.net produces a link that is safe to send to your end user over email. a) The link can only be used once, so the user can be sure that the password was not intercepted b) The link will expire after a certain amount of time, so that even if the user does not view the password, no one can come by later and retrieve the password. c) The entire site is SSL secure, and all passwords/links/etc are encrypted, as security was our main goal. I'm curious: How do you mean that this is not a secure solution?

Travis 17y ago
Fair enough, I was just curious exactly how you saw the issue. My concern on security is how do you transmit the PIN used to view the password? Unless I'm misunderstanding, and it's something more akin to pushing a password to another user's account. I think your product does a good job, I'm just not sure if the pain is sufficient to overcome the additional complexity of requiring yet another transaction to a third party. What advantage does this offer over a tokenized link that allows you to set your password? It could also expire on opening/set time, which would address the email/security issues above.