4 ms·
I just ask for an email address. I then email an auto generated password to the user. Their first login with the password I sent creates the account and takes t
by redstripe 15y ago
I just ask for an email address. I then email an auto generated password to the user. Their first login with the password I sent creates the account and takes them to their profile page which allows them to change their password or fill in other non essential info.
This system has a few benefits:
* No annoying "username already taken" or "password too short" rejections that make people give up.
* No junk accounts that haven't been verified since I don't create an account until the first login
* Person's email history has a record of their password if they're the type of person that doesn't care to change it.
* Since I'm really lazy, the account creation code is also the password recovery code. It just emails a new password.
I don't see any downsides with my system.
- aristidb 15y agoA downside might be that you send passwords over unencrypted e-mail?
- jrgnsd 15y agoA fix for this can be to use a randomly generated pin or hash to act as a one time password. It will still be going over unencrypted email, but it will only be valid until the user confirms the account and chooses his own password.
- uxp 15y agoAnd expiring after 10/30/60 days if not used. No reason to keep these useless records in the DB rotting away.
- lukifer 15y agoI consider this huge. Aside from the obvious man-in-the-middle network attacks that could capture this easily, it also creates a huge physical security flaw: if you save/archive your emails, I can sit down at your machine, type "password" in the search box of your mail client, and trivially steal a dozen or so of your passwords. If these weren't auto-generated, it's even worse, as most people re-use passwords.
- redstripe 15y agoIf someone has access to your email client you're hooped anyway. There is nothing stopping an extra security conscious user from deleting the email and changing their password right away. What it does is to give a convenience to users that want to treat your service as a trial. Picking unique user names and password is too far down the developing a relationship path for me personally.
- lukifer 15y agoAgainst knowledgeable techies, sure, you're hosed either way. I'm talking about more casual security threats: a mischievous child, a bad breakup, a sneaky Best Buy bench tech. It's the difference between leaving your front door unlocked, versus leaving it wide open.
- jules 15y agoDon't most sites offer password recovery via email?
- sorbits 15y ago> If someone has access to your email client you're hooped anyway. I once made the mistake of emailing a friend of mine the password to an ssh account — roughly 6 months later someone logged in with that password and added a spammy link to one of my HTML pages — my friends machine wasn’t hacked, but likely the (university) server storing his email had. Also, our online shop email the buyers from a generated non-guessable address (to track replies/bounces). Occasionally these receive spam. So I don’t trust that what I write in an email is only seen by the person it is sent to, unless the content is encrypted. And just for the records, I disabled password login and installed fail2ban long ago to avoid new server break-ins :)
- blake8086 15y agoConsidering the "forgot password" fallback for virtually every site is your email address, and you can't disable it, most websites are only as secure as your email security.
- bluesmoon 15y agobetter to send a single-use capability URL.