Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

But why can't I send people their passwords?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 181 posts

Re: But why can't I send people their passwords?

#21

Post by ajanuary »

jere wrote: post #5

> 7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would y…

I agree; this point shouldn't be about password reset emails being more secure, it should be about the fact you don't need to be able to email them their password to have a successful account recovery process.

That said, it can be more secure. Firstly, people reuse passwords, so intercepting a plaintext password gives you access not only to the account on that site, but also several others.

Secondly, if the link expires you can't use old account recovery emails to find out passwords. If you manage to compromise an account (rather than mitm), you can search through for old "here is your password" emails and use those without even having to initiate a new password recovery process, which in this age of mobile devices and push notifications risks the victim seeing the email and getting suspicious.

Re: But why can't I send people their passwords?

#23

Post by adwn »

LukeB_UK wrote: post #6

I disagree with point 11. You shouldn't rely on someone else's service to be the way for users to access yours.

Actually, that FAQ entry itself already counters your argument: "Treat it like you would payment - you wouldn’t write a whole payment gateway like PayPal - but instead use a 3rd party." Where's the difference?

By the way, you can always allow users to connect several OpenIDs to a single account – this way, worried users can provide redundancy themselves, if desired.

Re: But why can't I send people their passwords?

#24

Post by scrollaway »

blueatlas wrote: post #20

I was a bit surprised by #9.2 - "Don’t put any limitations on the passwords people can use (maximum lengths, disallowing certain characters, etc.)". What's the thinking here?

What is the thinking behind disallowing certain characters? When you create artificial limitations you have to justify them, not the other way around.

Re: But why can't I send people their passwords?

#25

Post by _mulder_ »

I'd suggest starting the answer to each question with a clear Yes or No, Right or Wrong so people can skim through.

Example:

>7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right?

No, Email is not a secure medium.....

Re: But why can't I send people their passwords?

#26

Post by scrollaway »

thesumofall wrote: post #17

For [11]: I think it makes sense to also highlight other approaches than OpenID such as https://passwordless.net which is a sort of way in the middle (disclaimer: I'm the author)

As a huge supporter of Persona, I am intrigued. Can you sell me on how this may be better?

Re: But why can't I send people their passwords?

#27

Post by powatom »

jere wrote: post #5

> 7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would y…

True - but you can add an additional layer of security to the password reset request if this is a concern, such as personal questions.

Re: But why can't I send people their passwords?

#28

Post by 3pt14159 »

jere wrote: post #5

> 7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would y…

The main reason not to do it is that people don't always have control over their email, for example, school, work, etc. Also, some courts can force you to give up an encryption password, but many can't. By sending a password in the clear you can be inadvertently giving the court a password that they otherwise wouldn't have had.

Re: But why can't I send people their passwords?

#29

Post by user24 »

blueatlas wrote: post #20

I was a bit surprised by #9.2 - "Don’t put any limitations on the passwords people can use (maximum lengths, disallowing certain characters, etc.)". What's the thinking here?

Can't speak for OP, but surely putting restrictions on your password just makes people choose weird, eminently forgettable passwords, a la xkcd's complaint http://xkcd.com/936/

Re: But why can't I send people their passwords?

#30

Post by adwn »

blueatlas wrote: post #20

I was a bit surprised by #9.2 - "Don’t put any limitations on the passwords people can use (maximum lengths, disallowing certain characters, etc.)". What's the thinking here?

> What's the thinking here?

I sucks for people that generate individual passwords based on a common password and site-specific data.

Post reply on HN