5 ms·
It's quite possible the dev knew it was a bad idea and maybe even argued against it but was told to implement it this way anyway. The problem a dating site pro
by jiggy2011 13y ago
It's quite possible the dev knew it was a bad idea and maybe even argued against it but was told to implement it this way anyway.
The problem a dating site probably has is people who sign up accounts and then stop using them. They want to send these users reminder emails in the hope that some of them re-engage.
Problem is that some of these users have probably forgotten which password they use for that website, and some % of those will not bother using the password reset mechanism.
So someone in marketing has the bright idea of sending emails that include the username/password combo, the dev explains why this is a terrible idea and then gets overruled.
- relix 13y agoI include an "Instant Login" link in each mail so the users don't need to remember their password. It contains a unique time-sensitive token to identify the user and instantly sign them in (much like a password reset). I learned this technique from OKCupid, so no idea why they still had plaintext passwords.
- jiggy2011 13y agoMaybe simply emailing the password still has a higher conversion rate than the one time link, for example if the user does not see or understand the link or perhaps they want to login later when their email is not open. It can be difficult to argue for security in cases where even small % of short term revenue might be affected.
- mortehu 13y agoIt turns out Cupid Media is unrelated to OkCupid.
- mcgwiz 13y agoI hope you educated your users not to forward any of that mail.
- kawsper 13y agoAfter how much time will the token expire?
- mattmanser 13y agoYeah, I'm being a bit hard on the original dev!