email security question...

MikeTheVike · Apr 7th, 2008, 18:43

I built a site using a cms that sends an email to people who registered that welcomes them to the site. It also shows their username and password in the email. I don't really see this as a problem, and I've seen lots of sites do this. But of course there has to be one guy who registers and gets all bent out of shape...

"You just sent me both my user name and my password in a clear text
email message. This is a very easy way to broadcast my credentials to
whoever cares to pluck them out of the email stream.

I hope you don't mind if I forward all the junk/spam increase I get to
you."

The site doesn't ask for things like credit card info, SS#, etc. I was hoping someone on this forum that knows more about security could let me know if this really is a problem. Thanks!

aso186 · Apr 7th, 2008, 19:18

If you want to be better safe than sorry, don't email them their password.

You can always offer a 'forgot password' system that sends a time-expired, one-time use password to their registered email address.

MikeTheVike · Apr 7th, 2008, 19:21

Quote:

Originally Posted by aso186

If you want to be better safe than sorry, don't email them their password.

You can always offer a 'forgot password' system that sends a time-expired, one-time use password to their registered email address.

I'm going to just remove the password from the email, its ironic, this guy that sent the email is sooo worried, but when I took a look at the website of the company he works for, their contact form is not secured and asks for a hell of a lot more information.

aerosieg · May 6th, 2008, 20:16

Encrypt your messages?

lol