Best practices for providing user name and password for a web-based app?

Would appreciate advise on best practices for setting up user accounts and passwords.

I have a web-based app running on a hosted Linux server, latest version Apache, PHP, SQL. SSL is used for this site.

It's necessary to allow some users of this app to setup accounts for other users. Here's how the process works today:
1)  User 1 logs in, we will call this user Admin.
2)  Admin creates a new user by entering form data which includes new user's name and email address. When Admin posts back to the server a random password is then created, encrypted (using hash/salt) and stored in SQL. The proper SQL-injection guards are in place.
3)  An email is then sent to the new user giving them both a username and the random password.
4)  When the new user logs in they are forced to change the password.

The Admin has to be trusted to have the correct email for the new user and be allowed to create new users on their own, that's not the issue. My concern is with the security of sending the username and password through email. But, I can't get my head around any other way to do this. If I change it so that a link is sent to the new user that info could be intercepted as easily as sending a username and password. The only verifiable data we have on the new user is their email.

What do best practices suggest?
jimdgar2Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

binaryevoCommented:
That's going to be tough if all you have is an email.  I'm not sure that you could effectively secure this other than the way you are already doing it.  My suggestion is to try and add a challenge question / response or something likewise in addition to the email so you have another means of authorizing the user when they login with the temp password.  This will obviously require them to know the information so it adds another level of security.
0
Olaf DoschkeSoftware DeveloperCommented:
How about changing the process?

Admin sends an invite to a user to create his own account, which is done in a normal fashion with the difference the admin needs to approve the new account before it gets active. Even if someone catches that invite (probably some invite code) or the invited user shares his invite, that only allows user account creation of dead accounts, even if not deactivating the invite code after it's usage, And all these accounts, but the first, will never be approved.

This way the password is never sent by mail.

But if you are concerned about the password sent by mail, you should also be concerned about the password being sent through http request, even as a POST request, this is cleartext, if the account creation and login are not done using SSL/https.

The only flaw this has is if a user shares his mail with friends, relatives or such. If they have access to the mailbox and can create the account and determine the password, be approved, delete the invite mail, and the real invited person never knows.

But that's perhaps less problematic than sending a password in mail.

Most webhosters I know simply do send out mails with passwords. You have to start somehow and if you don't allow anyone to create new accounts forcing a password change after first login is a feasable solution, too.

Bye, Olaf.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
PHP

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.