4 ms·
That doesn't sound like a safe way of resetting passwords. You should supply them a token they can use to set their own password. Your employees should not know
by desas 9y ago
That doesn't sound like a safe way of resetting passwords. You should supply them a token they can use to set their own password. Your employees should not know your users passwords.
- zaarn 9y agoIn a corporation, this is totally okay as long as the reset password is safe or the account is locked from external access until the password has been changed. The employee should of course change their password and that should be enforced policy, the admin shouldn't know user passwords. Tokens work too but it's a bit of an overhead, especially in smaller SMB where the admin is probably just across the corridor or atleast in the same building.
- will_hughes 9y agoThe token is the new one-time password that must be reset upon login.
- sdoering 9y agoExactly that. I use this feature as an Admin relatively often in Adobe Analytics. I never am able to know the "real" password a user provides on first login after reset. A one time password is nothing but a token - maybe not ideally named.