?
Solved

Best practices for providing user name and password for a web-based app?

Posted on 2012-04-11
2
Medium Priority
?
522 Views
Last Modified: 2012-06-21
Would appreciate advise on best practices for setting up user accounts and passwords.

I have a web-based app running on a hosted Linux server, latest version Apache, PHP, SQL. SSL is used for this site.

It's necessary to allow some users of this app to setup accounts for other users. Here's how the process works today:
1)  User 1 logs in, we will call this user Admin.
2)  Admin creates a new user by entering form data which includes new user's name and email address. When Admin posts back to the server a random password is then created, encrypted (using hash/salt) and stored in SQL. The proper SQL-injection guards are in place.
3)  An email is then sent to the new user giving them both a username and the random password.
4)  When the new user logs in they are forced to change the password.

The Admin has to be trusted to have the correct email for the new user and be allowed to create new users on their own, that's not the issue. My concern is with the security of sending the username and password through email. But, I can't get my head around any other way to do this. If I change it so that a link is sent to the new user that info could be intercepted as easily as sending a username and password. The only verifiable data we have on the new user is their email.

What do best practices suggest?
0
Comment
Question by:jimdgar2
2 Comments
 
LVL 14

Assisted Solution

by:binaryevo
binaryevo earned 1000 total points
ID: 37834594
That's going to be tough if all you have is an email.  I'm not sure that you could effectively secure this other than the way you are already doing it.  My suggestion is to try and add a challenge question / response or something likewise in addition to the email so you have another means of authorizing the user when they login with the temp password.  This will obviously require them to know the information so it adds another level of security.
0
 
LVL 30

Accepted Solution

by:
Olaf Doschke earned 1000 total points
ID: 37835180
How about changing the process?

Admin sends an invite to a user to create his own account, which is done in a normal fashion with the difference the admin needs to approve the new account before it gets active. Even if someone catches that invite (probably some invite code) or the invited user shares his invite, that only allows user account creation of dead accounts, even if not deactivating the invite code after it's usage, And all these accounts, but the first, will never be approved.

This way the password is never sent by mail.

But if you are concerned about the password sent by mail, you should also be concerned about the password being sent through http request, even as a POST request, this is cleartext, if the account creation and login are not done using SSL/https.

The only flaw this has is if a user shares his mail with friends, relatives or such. If they have access to the mailbox and can create the account and determine the password, be approved, delete the invite mail, and the real invited person never knows.

But that's perhaps less problematic than sending a password in mail.

Most webhosters I know simply do send out mails with passwords. You have to start somehow and if you don't allow anyone to create new accounts forcing a password change after first login is a feasable solution, too.

Bye, Olaf.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The recent Petya-like ransomware attack served a big blow to hundreds of banks, corporations and government offices The Acronis blog takes a closer look at this damaging worm to see what’s behind it – and offers up tips on how you can safeguard your…
This holiday season, we’re giving away the gift of knowledge—tech knowledge, that is. Keep reading to see what hacks, tips, and trends we have wrapped and waiting for you under the tree.
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.
The viewer will learn how to create a basic form using some HTML5 and PHP for later processing. Set up your basic HTML file. Open your form tag and set the method and action attributes.: (CODE) Set up your first few inputs one for the name and …
Suggested Courses
Course of the Month15 days, 12 hours left to enroll

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question