Core: Send password/activation link to new user

Created on 4 Jul 2015 · 14Comments · Source: owncloud/core

An e-mail can be sent to new users. It makes absolutely no sense that the password is not included since users can reset their passwords. This leads to rather strange user creation procedures:
https://forum.owncloud.org/viewtopic.php?f=21&t=29055#p90693 (in german)

@enoch85 already proposed this idea:
https://github.com/owncloud/core/issues/12603#issuecomment-66285419

blue-ticket enhancement junior job

Source

tflidd

Most helpful comment

Sending a link that then shows a page to allow the user to set it's own password is a proper way to handle this "create a user" case.

MorrisJobke on 6 Jul 2015

😄1 👍1

All 14 comments

cc @MorrisJobke @LukasReschke @jancborchardt

Xenopathic on 5 Jul 2015

Sending passwords via E-Mail is an absolutely no-go (at least if the user is not forced to change the password after the first login).

But maybe the mail could contain a link like the lost password page where they can set their own password.

It makes absolutely no sense that the password is not included since users can reset their passwords.

It makes sense as the mail including the password is very likely transported / saved unencrypted after arriving at the mailserver. The password reset page is normally encrypted and so the provider or any other institution (hopefully) can't get a hand on it.

ghost on 5 Jul 2015

Sending a link that then shows a page to allow the user to set it's own password is a proper way to handle this "create a user" case.

MorrisJobke on 6 Jul 2015

😄1 👍1

Sending a link that then shows a page to allow the user to set it's own password

Yes, this or sending a "One-Time-Password" to the user which needs to be changed on the first login (this needs to be enforced and not optional) are the only acceptable solutions for this.

ghost on 6 Jul 2015

What @MorrisJobke said. The one-time-password solution is just a complicated version of the easy link-to-set-own-password method.