4 ms·
The pain is the inability to quickly and easily send passwords to users. Faxes used to be the original way to send passwords, but now many places no longer have
by harisenbon 17y ago
The pain is the inability to quickly and easily send passwords to users. Faxes used to be the original way to send passwords, but now many places no longer have fax machines, and giving passwords over the phone leads to mistakes and it is often hard for users to recognize long passwords with upper/lowercase as well as punctuation.
The main reason that sending passwords through email is insecure is that :
a) the password stays in the mailbox of the user, and can be read at a later time
b) if the mail is intercepted by a hacker, the user will never realize that the mail has been read, and the hacker has access to the username/password
SendMyPassword.net produces a link that is safe to send to your end user over email.
a) The link can only be used once, so the user can be sure that the password was not intercepted
b) The link will expire after a certain amount of time, so that even if the user does not view the password, no one can come by later and retrieve the password.
c) The entire site is SSL secure, and all passwords/links/etc are encrypted, as security was our main goal.
I'm curious: How do you mean that this is not a secure solution?
- Travis 17y agoFair enough, I was just curious exactly how you saw the issue. My concern on security is how do you transmit the PIN used to view the password? Unless I'm misunderstanding, and it's something more akin to pushing a password to another user's account. I think your product does a good job, I'm just not sure if the pain is sufficient to overcome the additional complexity of requiring yet another transaction to a third party. What advantage does this offer over a tokenized link that allows you to set your password? It could also expire on opening/set time, which would address the email/security issues above.