Re:Chrome breaks the Web
by desas on Tuesday November 07, 2017 @02:26AM
(#15641583)
That doesn't sound like a safe way of resetting passwords. You should supply them a token they can use to set their own password. Your employees should not know your users passwords.
[ Parent
| on HN ]
Re:Chrome breaks the Web
by will_hughes on Tuesday November 07, 2017 @05:04AM
(#15642122)
The token is the new one-time password that must be reset upon login.
Exactly that. I use this feature as an Admin relatively often in Adobe Analytics. I never am able to know the "real" password a user provides on first login after reset.
A one time password is nothing but a token - maybe not ideally named.
In a corporation, this is totally okay as long as the reset password is safe or the account is locked from external access until the password has been changed.
The employee should of course change their password and that should be enforced policy, the admin shouldn't know user passwords.
Tokens work too but it's a bit of an overhead, especially in smaller SMB where the admin is probably just across the corridor or atleast in the same building.