How to prevent welcome email from including plain-text password?

Question

This is a basic security issue that I see violated in many BB systems.  Sending the user id as well as plain-text password in an email can be a serious security risk.  I would like to simply remove the password from the verification email (or, for that matter, any email that might include it in plain text).

Possible?

Answer 1

OK, I created a solution for this.  Here it is:

https://github.com/martin05rc/Q2A-Mod-2

 

 

Comments

Thank you for this patch martin05rc.
Ok I am just curious to know why it's bad practice to send the pwd in mail?
and if this patch avoids sending the pwd in plain text then what's the alternative?

---

Transmitting a password in unencrypted form is not a good practice.  It opens the user to hacking that could expose personal information and cause lots of issues (identity theft, etc.).  

Sending BOTH the user id and password on the same email, without any encryption, is even worst.  You are giving the potential attacker all the information in one spot.

Lots of people will receive such emails and keep them on their computer for reference.  This means that anyone with access to their computer can also steal their login information.

There's a lot more to it:

https://www.google.com/search?q=why+shouldn't+passwords+be+emailed+in+plain+text

The right approach is to double-verify the password during registration (enter the password twice) and then send a welcome email without the password.  It is the user's responsibility to remember it.  If they don't, they can always ask for a reset.