3 ms·
Lots of systems email users an initial password which must be changed at first login. It's not the world's most elegant solution, but it's also not terrible an
by Kadin 10y ago
Lots of systems email users an initial password which must be changed at first login. It's not the world's most elegant solution, but it's also not terrible and basically does an implicit email verification. I'm not sure that it's any worse than sending a URL with an embedded token that takes the user to a password-change page.
- stevetrewick 10y ago>but it's also not terrible It's terrible. Really. https://news.ycombinator.com/item?id=7943365 https://news.ycombinator.com/item?id=7943365
- NeutronBoy 10y agoLike everything in IT security, it's about your use case, threat matrix, and risk assessment.