Solved

Best practices for providing user name and password for a web-based app?

Posted on 2012-04-11
2
500 Views
Last Modified: 2012-06-21
Would appreciate advise on best practices for setting up user accounts and passwords.

I have a web-based app running on a hosted Linux server, latest version Apache, PHP, SQL. SSL is used for this site.

It's necessary to allow some users of this app to setup accounts for other users. Here's how the process works today:
1)  User 1 logs in, we will call this user Admin.
2)  Admin creates a new user by entering form data which includes new user's name and email address. When Admin posts back to the server a random password is then created, encrypted (using hash/salt) and stored in SQL. The proper SQL-injection guards are in place.
3)  An email is then sent to the new user giving them both a username and the random password.
4)  When the new user logs in they are forced to change the password.

The Admin has to be trusted to have the correct email for the new user and be allowed to create new users on their own, that's not the issue. My concern is with the security of sending the username and password through email. But, I can't get my head around any other way to do this. If I change it so that a link is sent to the new user that info could be intercepted as easily as sending a username and password. The only verifiable data we have on the new user is their email.

What do best practices suggest?
0
Comment
Question by:jimdgar2
2 Comments
 
LVL 14

Assisted Solution

by:binaryevo
binaryevo earned 250 total points
Comment Utility
That's going to be tough if all you have is an email.  I'm not sure that you could effectively secure this other than the way you are already doing it.  My suggestion is to try and add a challenge question / response or something likewise in addition to the email so you have another means of authorizing the user when they login with the temp password.  This will obviously require them to know the information so it adds another level of security.
0
 
LVL 29

Accepted Solution

by:
Olaf Doschke earned 250 total points
Comment Utility
How about changing the process?

Admin sends an invite to a user to create his own account, which is done in a normal fashion with the difference the admin needs to approve the new account before it gets active. Even if someone catches that invite (probably some invite code) or the invited user shares his invite, that only allows user account creation of dead accounts, even if not deactivating the invite code after it's usage, And all these accounts, but the first, will never be approved.

This way the password is never sent by mail.

But if you are concerned about the password sent by mail, you should also be concerned about the password being sent through http request, even as a POST request, this is cleartext, if the account creation and login are not done using SSL/https.

The only flaw this has is if a user shares his mail with friends, relatives or such. If they have access to the mailbox and can create the account and determine the password, be approved, delete the invite mail, and the real invited person never knows.

But that's perhaps less problematic than sending a password in mail.

Most webhosters I know simply do send out mails with passwords. You have to start somehow and if you don't allow anyone to create new accounts forcing a password change after first login is a feasable solution, too.

Bye, Olaf.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
htacces issue 2 37
mysql Encryption with PHP 8 45
php image upload 3 24
How search webpage "viewable text" only 1 25
Why do we like using grid based layouts in website design? Let's look at the live examples of websites and compare them to grid based WordPress themes.
These days socially coordinated efforts have turned into a critical requirement for enterprises.
This video teaches users how to migrate an existing Wordpress website to a new domain.
The viewer will learn how to dynamically set the form action using jQuery.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now