Solved

Best practices for providing user name and password for a web-based app?

Posted on 2012-04-11
2
508 Views
Last Modified: 2012-06-21
Would appreciate advise on best practices for setting up user accounts and passwords.

I have a web-based app running on a hosted Linux server, latest version Apache, PHP, SQL. SSL is used for this site.

It's necessary to allow some users of this app to setup accounts for other users. Here's how the process works today:
1)  User 1 logs in, we will call this user Admin.
2)  Admin creates a new user by entering form data which includes new user's name and email address. When Admin posts back to the server a random password is then created, encrypted (using hash/salt) and stored in SQL. The proper SQL-injection guards are in place.
3)  An email is then sent to the new user giving them both a username and the random password.
4)  When the new user logs in they are forced to change the password.

The Admin has to be trusted to have the correct email for the new user and be allowed to create new users on their own, that's not the issue. My concern is with the security of sending the username and password through email. But, I can't get my head around any other way to do this. If I change it so that a link is sent to the new user that info could be intercepted as easily as sending a username and password. The only verifiable data we have on the new user is their email.

What do best practices suggest?
0
Comment
Question by:jimdgar2
2 Comments
 
LVL 14

Assisted Solution

by:binaryevo
binaryevo earned 250 total points
ID: 37834594
That's going to be tough if all you have is an email.  I'm not sure that you could effectively secure this other than the way you are already doing it.  My suggestion is to try and add a challenge question / response or something likewise in addition to the email so you have another means of authorizing the user when they login with the temp password.  This will obviously require them to know the information so it adds another level of security.
0
 
LVL 29

Accepted Solution

by:
Olaf Doschke earned 250 total points
ID: 37835180
How about changing the process?

Admin sends an invite to a user to create his own account, which is done in a normal fashion with the difference the admin needs to approve the new account before it gets active. Even if someone catches that invite (probably some invite code) or the invited user shares his invite, that only allows user account creation of dead accounts, even if not deactivating the invite code after it's usage, And all these accounts, but the first, will never be approved.

This way the password is never sent by mail.

But if you are concerned about the password sent by mail, you should also be concerned about the password being sent through http request, even as a POST request, this is cleartext, if the account creation and login are not done using SSL/https.

The only flaw this has is if a user shares his mail with friends, relatives or such. If they have access to the mailbox and can create the account and determine the password, be approved, delete the invite mail, and the real invited person never knows.

But that's perhaps less problematic than sending a password in mail.

Most webhosters I know simply do send out mails with passwords. You have to start somehow and if you don't allow anyone to create new accounts forcing a password change after first login is a feasable solution, too.

Bye, Olaf.
0

Featured Post

3 Use Cases for Connected Systems

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, testing some more, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Any business that wants to seriously grow needs to keep the needs and desires of an international audience of their websites in mind. Making a website friendly to international users isn’t prohibitively expensive and can provide an incredible return…
This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question