But why can't I send people their passwords?

Re:But why can't I send people their passwords? by krambs on Wednesday June 25, 2014 @09:35AM (#7943750)

You shouldn't send the password because you shouldn't be storing the password. Worries about email security, etc. are secondary.

[ Parent | on HN ]

Re:But why can't I send people their passwords? by larrybrid on Wednesday June 25, 2014 @10:23AM (#7944032)

Yeah, I was surprised to see that this bit wasn't mentioned anywhere. If you are emailing someone their password in plaintext, that means you know their password in plaintext -- which you should not.

[ Parent | on HN ]

Re:But why can't I send people their passwords? by MertsA on Wednesday June 25, 2014 @10:59AM (#7944344)

That's not quite true, most random web services send out the welcome email from the same page that just hashed your password so during email creation they still have the plaintext copy around even though it dies after the request ends.

[ Parent | on HN ]

Re:But why can't I send people their passwords? by jere on Wednesday June 25, 2014 @10:50AM (#7944252)

You do when they first create it.

[ Parent | on HN ]

Re:But why can't I send people their passwords? by yebyen on Wednesday June 25, 2014 @03:23PM (#7946208)

And every time they enter it to log in, up until the moment when it's hashed and (maybe the memory is overwritten with zeros before being) garbage collected.

[ Parent | on HN ]

Re:But why can't I send people their passwords? by omervk on Wednesday June 25, 2014 @12:15PM (#7944877)

Yes, that's in the FAQ too.

[ Parent | on HN ]