Re:Ask HN: The correct way to email users their PLAINTEXT pa...
by JoachimSchipper on Monday January 16, 2012 @09:40AM
(#3470745)
Why don't you simply port the user accounts to your system (including passwords, stored hashed this time) and be done with it? "Plaintext passwords bad", of course, but I don't even see what you hope to gain - don't you already have a password recovery system for your current subscribers? (And a one-click-from-email login may be nice, but again - why not for current subscribers?)
[ Parent
| on HN ]
Re:Ask HN: The correct way to email users their PLAINTEXT pa...
by chrisacky on Monday January 16, 2012 @09:53AM
(#3470796)
Yeah, don't think that I would maintain the plain text passwords. After I create the hashed version, I would drop the plain text and rm -rf the old site. (Well not quite but it will be on it's on from there on).
My concern isn't so much about what to do in the future, because from here on out, we will only be using the hashed passwords...
I guess the original question could of been summarized to:
"Do you think that non-technical people realise that when they receive their passwords in an email that this is bad".
Because I would like to make the transition for the users as easy as possible. They will now be accessing and editing their details from the new site.
Re:Ask HN: The correct way to email users their PLAINTEXT pa...
by japhyr on Monday January 16, 2012 @10:04AM
(#3470834)
You can just tell the users that their old accounts should work perfectly well on the new system. You can't sort out "non-technical" people from technical people in your userbase. Bad practice is bad practice, and anything to do with plain text passwords is bad practice.