Mixing
Should the manager be CC'd when sending username and password to employee
Clash Royale CLAN TAG#URR8PPP
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty margin-bottom:0;
up vote
28
down vote
favorite
I often create logins for new employees and then send them an email with their login credentials. While doing so I also CC their manager to let him know his user has been setup.
Is this the right thing to do? Should the manager be CC'd when sending a username and password to the user?
In this case, the employes are part of an operation team who basically process paperwork and things in the database. They do not do anything confidential as such, but of course are responsible for what they do.
employees email security
edited Jul 26 '12 at 21:36
yoozer8
4,10442955
asked Jul 26 '12 at 19:32
enthusiast
786622
 |Â
show 1 more comment
up vote
28
down vote
favorite
I often create logins for new employees and then send them an email with their login credentials. While doing so I also CC their manager to let him know his user has been setup.
Is this the right thing to do? Should the manager be CC'd when sending a username and password to the user?
In this case, the employes are part of an operation team who basically process paperwork and things in the database. They do not do anything confidential as such, but of course are responsible for what they do.
employees email security
edited Jul 26 '12 at 21:36
yoozer8
4,10442955
asked Jul 26 '12 at 19:32
enthusiast
786622
3
Where do you send this e-mail? That is, how does the user access their login credentials in the first place? (That said, I fully agree with @Oded's answer.)
– Michael Kjörling
Jul 27 '12 at 7:49
11
Hopefully A) this password is a random string and B) its only a one time use as sending any credentials in plaintext (let alone storing them) is both stupid and dangerous
– rickyduck
Jul 27 '12 at 9:00
If this is a new account, how are they going to log on to pick up the e-mail containing their password? In that situation, sending the initial password to the boss is usually the best option available.
– keshlam
May 4 '16 at 9:19
Why do you send them to the new user at all? How are they supposed to retrieve them? It would seem that sending the full credentials to the manager is the only way for the new account holder to receive them, correct?
– MrWonderful
Jun 8 '16 at 21:23
Inform the boss that a new account has been created but do not mail password. And by the way, the password you email MUST be a single use password...
– Caterpillaraoz
Sep 28 '17 at 12:20
 |Â
show 1 more comment
up vote
28
down vote
favorite
up vote
28
down vote
favorite
I often create logins for new employees and then send them an email with their login credentials. While doing so I also CC their manager to let him know his user has been setup.
Is this the right thing to do? Should the manager be CC'd when sending a username and password to the user?
In this case, the employes are part of an operation team who basically process paperwork and things in the database. They do not do anything confidential as such, but of course are responsible for what they do.
employees email security
edited Jul 26 '12 at 21:36
yoozer8
4,10442955
asked Jul 26 '12 at 19:32
enthusiast
786622
I often create logins for new employees and then send them an email with their login credentials. While doing so I also CC their manager to let him know his user has been setup.
Is this the right thing to do? Should the manager be CC'd when sending a username and password to the user?
In this case, the employes are part of an operation team who basically process paperwork and things in the database. They do not do anything confidential as such, but of course are responsible for what they do.
employees email security
edited Jul 26 '12 at 21:36
yoozer8
4,10442955
asked Jul 26 '12 at 19:32
enthusiast
786622
edited Jul 26 '12 at 21:36
yoozer8
4,10442955
edited Jul 26 '12 at 21:36
yoozer8
4,10442955
edited Jul 26 '12 at 21:36
yoozer8
4,10442955
4,10442955
asked Jul 26 '12 at 19:32
enthusiast
786622
asked Jul 26 '12 at 19:32
enthusiast
786622
asked Jul 26 '12 at 19:32
enthusiast
786622
786622
3
Where do you send this e-mail? That is, how does the user access their login credentials in the first place? (That said, I fully agree with @Oded's answer.)
– Michael Kjörling
Jul 27 '12 at 7:49
11
Hopefully A) this password is a random string and B) its only a one time use as sending any credentials in plaintext (let alone storing them) is both stupid and dangerous
– rickyduck
Jul 27 '12 at 9:00
If this is a new account, how are they going to log on to pick up the e-mail containing their password? In that situation, sending the initial password to the boss is usually the best option available.
– keshlam
May 4 '16 at 9:19
Why do you send them to the new user at all? How are they supposed to retrieve them? It would seem that sending the full credentials to the manager is the only way for the new account holder to receive them, correct?
– MrWonderful
Jun 8 '16 at 21:23
Inform the boss that a new account has been created but do not mail password. And by the way, the password you email MUST be a single use password...
– Caterpillaraoz
Sep 28 '17 at 12:20
 |Â
show 1 more comment
3
Where do you send this e-mail? That is, how does the user access their login credentials in the first place? (That said, I fully agree with @Oded's answer.)
– Michael Kjörling
Jul 27 '12 at 7:49
11
Hopefully A) this password is a random string and B) its only a one time use as sending any credentials in plaintext (let alone storing them) is both stupid and dangerous
– rickyduck
Jul 27 '12 at 9:00
If this is a new account, how are they going to log on to pick up the e-mail containing their password? In that situation, sending the initial password to the boss is usually the best option available.
– keshlam
May 4 '16 at 9:19
Why do you send them to the new user at all? How are they supposed to retrieve them? It would seem that sending the full credentials to the manager is the only way for the new account holder to receive them, correct?
– MrWonderful
Jun 8 '16 at 21:23
Inform the boss that a new account has been created but do not mail password. And by the way, the password you email MUST be a single use password...
– Caterpillaraoz
Sep 28 '17 at 12:20
3
3
Where do you send this e-mail? That is, how does the user access their login credentials in the first place? (That said, I fully agree with @Oded's answer.)
– Michael Kjörling
Jul 27 '12 at 7:49
Where do you send this e-mail? That is, how does the user access their login credentials in the first place? (That said, I fully agree with @Oded's answer.)
– Michael Kjörling
Jul 27 '12 at 7:49
11
11
Hopefully A) this password is a random string and B) its only a one time use as sending any credentials in plaintext (let alone storing them) is both stupid and dangerous
– rickyduck
Jul 27 '12 at 9:00
Hopefully A) this password is a random string and B) its only a one time use as sending any credentials in plaintext (let alone storing them) is both stupid and dangerous
– rickyduck
Jul 27 '12 at 9:00
If this is a new account, how are they going to log on to pick up the e-mail containing their password? In that situation, sending the initial password to the boss is usually the best option available.
– keshlam
May 4 '16 at 9:19
If this is a new account, how are they going to log on to pick up the e-mail containing their password? In that situation, sending the initial password to the boss is usually the best option available.
– keshlam
May 4 '16 at 9:19
Why do you send them to the new user at all? How are they supposed to retrieve them? It would seem that sending the full credentials to the manager is the only way for the new account holder to receive them, correct?
– MrWonderful
Jun 8 '16 at 21:23
Why do you send them to the new user at all? How are they supposed to retrieve them? It would seem that sending the full credentials to the manager is the only way for the new account holder to receive them, correct?
– MrWonderful
Jun 8 '16 at 21:23
Inform the boss that a new account has been created but do not mail password. And by the way, the password you email MUST be a single use password...
– Caterpillaraoz
Sep 28 '17 at 12:20
Inform the boss that a new account has been created but do not mail password. And by the way, the password you email MUST be a single use password...
– Caterpillaraoz
Sep 28 '17 at 12:20
 |Â
show 1 more comment
11 Answers
11
active
oldest
votes
up vote
102
down vote
accepted
You should inform the manager that the credentials were created.
You should not send said credentials to the manager - in particular, if you have an audit trail that involves users, how can you be certain that when such a user is flagged by the system it is indeed the user and not their manager?
The whole point of login credentials is to ensure a logged in user is who they say they are (authentication), in order to give them access to whatever they need (authorization) and in some cases to allow for an audit trail.
Giving their credentials to someone else completely subverts this.
answered Jul 26 '12 at 19:35
Oded
21.1k57597
8
I guess I was doing it wrong.
– enthusiast
Jul 26 '12 at 19:51
5
Well, that's only a real problem if the credentials are permanent; after all, the admin ('you') know them too! If the credentials require a change on first login, this is less of a problem.
– Clockwork-Muse
Jul 26 '12 at 21:45
14
At our workplace, not even the IT know the passwords. Every new user is prompted at login to change their password after given a default one. Then every 90 days, we get asked to change it again. If we forget our password, we ask IT and they assign a generic password where we are again asked to change it when we log in. We use Windows.
– user2059
Jul 26 '12 at 22:50
2
Another point to make is that if those credentials are provided by the user and you forward them to the manager, how do you know you're not inadvertently sending the user's banking password to the manager as well!
– jmort253♦
Jul 26 '12 at 23:09
11
@Thecrocodilehunter - No time like now to change these traditions... As others have commented, in many environments, an initial password is setup which the system requires the user to change as soon as they log-in the first time. There is no password recovery service either - if the user forgot their new password, the admin will set a new one with the same condition - it needs to be changed as soon as the user logs in. This keeps the password secure with the user. The status quo you have is not a good one, change it for a better system.
– Oded
Jul 27 '12 at 13:11
 |Â
show 3 more comments
up vote
17
down vote
Sure, go ahead - as long as the user is required to change the password upon first login. They are, right? I mean, the goal here is to get the employee their credentials, and prove you've done so / get them to someone with a vested interest in assisting that new employee, while maintaining security.
This way you get all that, plus the user has to change their password "on first login" or whatever it's called now, so nothing is compromised.
I've seen systems that handle password changes this way too - forget your password, they email a new (temporary) one to your direct manager.
answered Jul 26 '12 at 21:45
Mark Allen
27926
2
And as long as "I got my credentials but they are not working" are properly followed up on, instead of just regenerated.
– Konerak
May 4 '16 at 11:13
-1 I would say that a manager should never see any of their employees' passwords, even if those passwords will be changed as soon as the employee logs in for the first time. What if, for example, an evil manager logs in as their employee and changes the password to something the employee doesn't know, then blames the employee for not getting work done while locked out of their computer? If the manager never sees the employee's credentials, such a scenario is impossible.
– Kevin
Aug 23 '16 at 21:58
@Kevin I was working under the assumption - as stated in the answer - that the manager has a vested interest in assisting their own employee. If they don't then there are bigger problems than changing ones password.
– Mark Allen
Aug 24 '16 at 23:31
@MarkAllen: If the manager is/was planning on sabotaging the employee/company, they had a large problem...which just got worse!
– jmoreno
Mar 28 at 0:04
add a comment |Â
up vote
17
down vote
You can send two emails for this. This is what is followed in our company and the managers never have a problem with it.
To: Employee
Cc: Manager1, Manager2
Dear Employee,
You have been registered in the system. Your username is firstname.lastname.
To adhere to the company's security policies, the password will be sent in the next e-mail marked only to you.
Regards, IT Team
To: Employee
Dear Employee,
The password to the username firstname.lastname is mynewpassword. We request you to change it immediately.
Regards, IT Team
edited Jul 27 '12 at 9:43
gnat
3,23273066
answered Jul 27 '12 at 6:34
Sahil
340412
7
It would seem that including the username and password in the second email negates the point of sending username and password separately!
– Jeromy French
Jan 11 '13 at 19:58
@JeromyFrench: How so? The point is that the second e-mail is sent only to the employee, not to the manager(s). (Sending plain-text passwords by e-mail is another issue, which is discussed by the other answers.)
– Keith Thompson
Jan 12 '13 at 1:39
3
Jeromy is right. Seding both the username and the password in the second email means a) anyone intercepting that email can login to the account b) the first email is pointless. The second email should read "the password of your recently created account is 'mynewpassword'"
– DJClayworth
Jan 14 '13 at 14:56
7
How is the employee going to receive the password if he can not log in to the system to get his email?
– IDrinkandIKnowThings
Jan 14 '13 at 15:00
@DJClayworth The first email is not pointless. Although the employee receives the actual login name twice, it means that everyone knows that the login has been set up, everyone knows that everyone else knows that, and everyone knows that noone has the password except the employee.
– Julia Hayward
May 4 '16 at 9:53
add a comment |Â
up vote
14
down vote
While it's appropriate to send a password via email, that password must be temporary; upon first login, the system must force a password change. Most enterprise-grade products support this option.
The problem is that credentials should not be stored anywhere in the open -- email least of all, since that's the first place attackers will look. Sending the password in a separate email doesn't really help, since a hacker who gets into your email will be able to see both messages, so you're no safer that way. Also, you may be required by a manager or anyone else for that matter to copy them on emails like this, significantly increasing your attack surface and the likelihood of an attacker getting the password.
The best solution is to simply force the user to change his password. Do not request that that the user change his password, since he never will. There are thousands of accounts out there with the password 12345 which was assigned as a temporary password and which the user was requested to change... and which he never did change.
answered Jul 27 '12 at 9:11
tylerl
24115
+1 for mentioning the industry-condoned practice of communicating the login credentials.
– Jas
May 4 '16 at 8:04
add a comment |Â
up vote
10
down vote
NO! it is not - this is security and sysadmin 101.
Also you do not ever send the user name and password in the clear, in the same document. Best practice is to create a temp password and communicate this to the employee via some other method and have the user change the password on login.
edited Jan 14 '13 at 13:24
alroc
12.8k23954
answered Jul 27 '12 at 14:20
Neuro
467512
add a comment |Â
up vote
5
down vote
No, the password should not even be in the email in the first place. At my place of work, one tells the login ID to a user and requests the user to call IT to obtain a temporary password.
There are some other security considerations to think about.
If your company has the robust technology to support it, passwords should be hashed using a strong algorithm.
The email itself should be sent encrypted.
Avoid using SSL and early version TLS as the encryption method as these are longer considered secure.
AES can be used to encrypt symmetrically or a algorithm like RSA can be used to encrypt asymmetrically (2 keys)Secure emails with sensitive information should be digitally signed so that the recipient can verify the authenticity of the sender and to ensure non - repudiation by the sender.
A one way hash function such as HMAC-SHA 256 is applied to transform email into a cryptographic message digest. Do not sign using the SHA 1 algorithm as such algorithm has been cryptographically broken and is no longer secure as a result. Using PKI, a private key only you know is used to encrypt. Once the receiver uses your public key to decrypt, the resulting message hash should be the same. The public key is protected from tampering by a certificate that binds the identity of the owner with his / her public key. The certificate is obtained via a CA upon validating the credentials you supplied in your certificate request.
Otherwise, message integrity is lost and the received message cannot be trusted to be the message you sent.
The private key is known only to the sender and is associated with a unique public key known to the receiver of the email. By the fact that the receiver is able to use the public key associated with the sender of the email to decrypt the email message, means that the sender cannot deny having sent the message>>
Point 2 ensures that the Confidentiality of the email is not compromised. Confidentiality means no unauthorized disclosure occurred such as through MITM.
Point 3 ensures integrity and non - repudiation or that the contents of the email has not been altered by an unauthorized party, and that sender of the email cannot deny having sent the email, due to the presence of his or her public key used to decrypt the message by the receiver of the email.
Finally, you can mask the data when displayed for extra security.
answered May 4 '16 at 23:23
Anthony
5,2391355
This should be the accepted answer. See also this security.SE question and answer.
– shoover
May 5 '16 at 15:26
add a comment |Â
up vote
4
down vote
If you're asking this, then you're in IT. ask your boss what company policy is. That's the safest path. Otherwise, I'd be inclined to say no, do not give managers the credentials.
However, ALWAYS let the manager know that a logon has been created for their underling. If they then request the credentials, ask them to submit that via your boss, so that it goes through proper channels.
answered Jul 26 '12 at 20:40
acolyte
3,0531632
3
If they're requesting the credentials, something is majorly wrong.
– jmort253♦
Jul 26 '12 at 23:10
@jmort253 not neccessarily. generally, it's not good. but in some cases it's fine. case-by-case basis. after all, if the employee is sick, and was supposed to give a presentation, the boss might request access to employee's machine to pull up relavent files in order to give presentation themself
– acolyte
Jul 27 '12 at 5:07
2
Then that's a risk that should be factored in. Bob shouldn't be the only person to have access to the files. The manager should be able to use his/her own login to access the system. As Oded says, the whole point of authentication is to verify that the person accessing a resource is who he/she says he is. For instance, that's why Google Docs has a sharing feature, so I don't have to give you access to all my stuff. In this case, the something that's majorly wrong is the lack of planning on the part of the employee, manager, and IT department.
– jmort253♦
Jul 27 '12 at 7:24
add a comment |Â
up vote
3
down vote
I deal with this regularly.
This is my best solution so far:
- I have created a small script that creates the user account, sets the password (I pull from dinopass.com, but whatever you want), and assigns the user to their job role (active directory group). The password is set to require reset at the first login.
- The script then generates a text file with the user's login and password. It also includes simple instructions for logging on, and the support desk phone / extension.
- I PRINT the text file (ordinarily I hate printing, but in this case, yes), put the printout in a sealed envelope with the new employee's name on it, and give that to the manager.
Obviously this may not work if your organization is so large that you have multiple campuses, but this method:
- Secures the password from "nosy" coworkers.
- Forces the password to be reset on first logon.
- Clearly communicates to the manager that the task is done.
- Helps establish that the employee's first line of inquiry is to their manager, not to the help desk.
Obviously this works well in a single-building environment, but it does work very well for me. It also lets my front-line techs handle things easily, as I just give them the script (C# Console App that asks for user's first/last name, and pick employee role).
Hope it helps you.
answered May 4 '16 at 22:20
Wesley Long
45.1k15100162
add a comment |Â
up vote
1
down vote
If you are located near the new employees you can have them pickup a hard copy of the login information. You will just need to let the manager know that it is ready.
If there is a great distance between you and the employees, you will have to email the manger the credentials. This is to let them give the credentials to the new employee.
I worked for a place that tried to tell you to pickup the passwords by leaving a voice mail. They also sent you an email to tell you your voice mail was now enabled. Needless to say that method didn't work very well for new employees.
I also sent credentials to a manger once because the employee wouldn't try to login. They told their manager they never got them. After 4 or 5 cycles of creating a new temporary password and sending it out, they miraculously arrived after I also sent them to the manager.
answered Jul 26 '12 at 19:45
mhoran_psprep
40.3k463144
add a comment |Â
up vote
0
down vote
A solution I've used, but didn't see suggested: Send the new user an email letting them know their account has been set up. If cc'ing their manager seems appropriate or necessary, then do so. However, you send them your telephone number and have them call (or visit) you to get their credentials. Or, you might send them their login id in this email; however, do not send the password via email.
answered Jan 11 '13 at 19:48
GreenMatt
15.6k1465109
add a comment |Â
up vote
0
down vote
Imagine some criminal damage is done, with incontrovertible evidence that it was done by someone having that person's username and password. Now you have a problem. There are two people, and you are quite sure that one is a criminal and one is quite innocent. Your company has a big problem. In Europe you have a huge problem because you know someone caused criminal damage and you can't fire them. In the USA, you still have a huge problem because there are two persons that you could fire, but one of them is totally innocent and you would lose what is likely a good employee. In addition, the employee and the manager know this, so it's likely the damage wouldn't have been done if only one person knew the password.
Nobody but that user must know the password. IT may have means to reset the password, and may be able to get into the computer after resetting the password, but they also must not know the current password and must not be able to change the password, cause damage from that user's account, and change the password back.
answered May 4 '16 at 7:45
gnasher729
71.8k31134226
add a comment |Â
StackExchange.ready(function ()
$("#show-editor-button input, #show-editor-button button").click(function ()
var showEditor = function()
$("#show-editor-button").hide();
$("#post-form").removeClass("dno");
StackExchange.editor.finallyInit();
;
var useFancy = $(this).data('confirm-use-fancy');
if(useFancy == 'True')
var popupTitle = $(this).data('confirm-fancy-title');
var popupBody = $(this).data('confirm-fancy-body');
var popupAccept = $(this).data('confirm-fancy-accept-button');
$(this).loadPopup(
url: '/post/self-answer-popup',
loaded: function(popup)
var pTitle = $(popup).find('h2');
var pBody = $(popup).find('.popup-body');
var pSubmit = $(popup).find('.popup-submit');
pTitle.text(popupTitle);
pBody.html(popupBody);
pSubmit.val(popupAccept).click(showEditor);
)
else
var confirmText = $(this).data('confirm-text');
if (confirmText ? confirm(confirmText) : true)
showEditor();
);
);
11 Answers
11
active
oldest
votes
11 Answers
11
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
102
down vote
accepted
You should inform the manager that the credentials were created.
You should not send said credentials to the manager - in particular, if you have an audit trail that involves users, how can you be certain that when such a user is flagged by the system it is indeed the user and not their manager?
The whole point of login credentials is to ensure a logged in user is who they say they are (authentication), in order to give them access to whatever they need (authorization) and in some cases to allow for an audit trail.
Giving their credentials to someone else completely subverts this.
answered Jul 26 '12 at 19:35
Oded
21.1k57597
8
I guess I was doing it wrong.
– enthusiast
Jul 26 '12 at 19:51
5
Well, that's only a real problem if the credentials are permanent; after all, the admin ('you') know them too! If the credentials require a change on first login, this is less of a problem.
– Clockwork-Muse
Jul 26 '12 at 21:45
14
At our workplace, not even the IT know the passwords. Every new user is prompted at login to change their password after given a default one. Then every 90 days, we get asked to change it again. If we forget our password, we ask IT and they assign a generic password where we are again asked to change it when we log in. We use Windows.
– user2059
Jul 26 '12 at 22:50
2
Another point to make is that if those credentials are provided by the user and you forward them to the manager, how do you know you're not inadvertently sending the user's banking password to the manager as well!
– jmort253♦
Jul 26 '12 at 23:09
11
@Thecrocodilehunter - No time like now to change these traditions... As others have commented, in many environments, an initial password is setup which the system requires the user to change as soon as they log-in the first time. There is no password recovery service either - if the user forgot their new password, the admin will set a new one with the same condition - it needs to be changed as soon as the user logs in. This keeps the password secure with the user. The status quo you have is not a good one, change it for a better system.
– Oded
Jul 27 '12 at 13:11
 |Â
show 3 more comments
up vote
102
down vote
accepted
You should inform the manager that the credentials were created.
You should not send said credentials to the manager - in particular, if you have an audit trail that involves users, how can you be certain that when such a user is flagged by the system it is indeed the user and not their manager?
The whole point of login credentials is to ensure a logged in user is who they say they are (authentication), in order to give them access to whatever they need (authorization) and in some cases to allow for an audit trail.
Giving their credentials to someone else completely subverts this.
answered Jul 26 '12 at 19:35
Oded
21.1k57597
8
I guess I was doing it wrong.
– enthusiast
Jul 26 '12 at 19:51
5
Well, that's only a real problem if the credentials are permanent; after all, the admin ('you') know them too! If the credentials require a change on first login, this is less of a problem.
– Clockwork-Muse
Jul 26 '12 at 21:45
14
At our workplace, not even the IT know the passwords. Every new user is prompted at login to change their password after given a default one. Then every 90 days, we get asked to change it again. If we forget our password, we ask IT and they assign a generic password where we are again asked to change it when we log in. We use Windows.
– user2059
Jul 26 '12 at 22:50
2
Another point to make is that if those credentials are provided by the user and you forward them to the manager, how do you know you're not inadvertently sending the user's banking password to the manager as well!
– jmort253♦
Jul 26 '12 at 23:09
11
@Thecrocodilehunter - No time like now to change these traditions... As others have commented, in many environments, an initial password is setup which the system requires the user to change as soon as they log-in the first time. There is no password recovery service either - if the user forgot their new password, the admin will set a new one with the same condition - it needs to be changed as soon as the user logs in. This keeps the password secure with the user. The status quo you have is not a good one, change it for a better system.
– Oded
Jul 27 '12 at 13:11
 |Â
show 3 more comments
up vote
102
down vote
accepted
up vote
102
down vote
accepted
You should inform the manager that the credentials were created.
You should not send said credentials to the manager - in particular, if you have an audit trail that involves users, how can you be certain that when such a user is flagged by the system it is indeed the user and not their manager?
The whole point of login credentials is to ensure a logged in user is who they say they are (authentication), in order to give them access to whatever they need (authorization) and in some cases to allow for an audit trail.
Giving their credentials to someone else completely subverts this.
answered Jul 26 '12 at 19:35
Oded
21.1k57597
You should inform the manager that the credentials were created.
You should not send said credentials to the manager - in particular, if you have an audit trail that involves users, how can you be certain that when such a user is flagged by the system it is indeed the user and not their manager?
The whole point of login credentials is to ensure a logged in user is who they say they are (authentication), in order to give them access to whatever they need (authorization) and in some cases to allow for an audit trail.
Giving their credentials to someone else completely subverts this.
answered Jul 26 '12 at 19:35
Oded
21.1k57597
answered Jul 26 '12 at 19:35
Oded
21.1k57597
answered Jul 26 '12 at 19:35
Oded
21.1k57597
answered Jul 26 '12 at 19:35
Oded
21.1k57597
21.1k57597
8
I guess I was doing it wrong.
– enthusiast
Jul 26 '12 at 19:51
5
Well, that's only a real problem if the credentials are permanent; after all, the admin ('you') know them too! If the credentials require a change on first login, this is less of a problem.
– Clockwork-Muse
Jul 26 '12 at 21:45
14
At our workplace, not even the IT know the passwords. Every new user is prompted at login to change their password after given a default one. Then every 90 days, we get asked to change it again. If we forget our password, we ask IT and they assign a generic password where we are again asked to change it when we log in. We use Windows.
– user2059
Jul 26 '12 at 22:50
2
Another point to make is that if those credentials are provided by the user and you forward them to the manager, how do you know you're not inadvertently sending the user's banking password to the manager as well!
– jmort253♦
Jul 26 '12 at 23:09
11
@Thecrocodilehunter - No time like now to change these traditions... As others have commented, in many environments, an initial password is setup which the system requires the user to change as soon as they log-in the first time. There is no password recovery service either - if the user forgot their new password, the admin will set a new one with the same condition - it needs to be changed as soon as the user logs in. This keeps the password secure with the user. The status quo you have is not a good one, change it for a better system.
– Oded
Jul 27 '12 at 13:11
 |Â
show 3 more comments
8
I guess I was doing it wrong.
– enthusiast
Jul 26 '12 at 19:51
5
Well, that's only a real problem if the credentials are permanent; after all, the admin ('you') know them too! If the credentials require a change on first login, this is less of a problem.
– Clockwork-Muse
Jul 26 '12 at 21:45
14
At our workplace, not even the IT know the passwords. Every new user is prompted at login to change their password after given a default one. Then every 90 days, we get asked to change it again. If we forget our password, we ask IT and they assign a generic password where we are again asked to change it when we log in. We use Windows.
– user2059
Jul 26 '12 at 22:50
2
Another point to make is that if those credentials are provided by the user and you forward them to the manager, how do you know you're not inadvertently sending the user's banking password to the manager as well!
– jmort253♦
Jul 26 '12 at 23:09
11
@Thecrocodilehunter - No time like now to change these traditions... As others have commented, in many environments, an initial password is setup which the system requires the user to change as soon as they log-in the first time. There is no password recovery service either - if the user forgot their new password, the admin will set a new one with the same condition - it needs to be changed as soon as the user logs in. This keeps the password secure with the user. The status quo you have is not a good one, change it for a better system.
– Oded
Jul 27 '12 at 13:11
8
8
I guess I was doing it wrong.
– enthusiast
Jul 26 '12 at 19:51
I guess I was doing it wrong.
– enthusiast
Jul 26 '12 at 19:51
5
5
Well, that's only a real problem if the credentials are permanent; after all, the admin ('you') know them too! If the credentials require a change on first login, this is less of a problem.
– Clockwork-Muse
Jul 26 '12 at 21:45
Well, that's only a real problem if the credentials are permanent; after all, the admin ('you') know them too! If the credentials require a change on first login, this is less of a problem.
– Clockwork-Muse
Jul 26 '12 at 21:45
14
14
At our workplace, not even the IT know the passwords. Every new user is prompted at login to change their password after given a default one. Then every 90 days, we get asked to change it again. If we forget our password, we ask IT and they assign a generic password where we are again asked to change it when we log in. We use Windows.
– user2059
Jul 26 '12 at 22:50
At our workplace, not even the IT know the passwords. Every new user is prompted at login to change their password after given a default one. Then every 90 days, we get asked to change it again. If we forget our password, we ask IT and they assign a generic password where we are again asked to change it when we log in. We use Windows.
– user2059
Jul 26 '12 at 22:50
2
2
Another point to make is that if those credentials are provided by the user and you forward them to the manager, how do you know you're not inadvertently sending the user's banking password to the manager as well!
– jmort253♦
Jul 26 '12 at 23:09
Another point to make is that if those credentials are provided by the user and you forward them to the manager, how do you know you're not inadvertently sending the user's banking password to the manager as well!
– jmort253♦
Jul 26 '12 at 23:09
11
11
@Thecrocodilehunter - No time like now to change these traditions... As others have commented, in many environments, an initial password is setup which the system requires the user to change as soon as they log-in the first time. There is no password recovery service either - if the user forgot their new password, the admin will set a new one with the same condition - it needs to be changed as soon as the user logs in. This keeps the password secure with the user. The status quo you have is not a good one, change it for a better system.
– Oded
Jul 27 '12 at 13:11
@Thecrocodilehunter - No time like now to change these traditions... As others have commented, in many environments, an initial password is setup which the system requires the user to change as soon as they log-in the first time. There is no password recovery service either - if the user forgot their new password, the admin will set a new one with the same condition - it needs to be changed as soon as the user logs in. This keeps the password secure with the user. The status quo you have is not a good one, change it for a better system.
– Oded
Jul 27 '12 at 13:11
 |Â
show 3 more comments
up vote
17
down vote
Sure, go ahead - as long as the user is required to change the password upon first login. They are, right? I mean, the goal here is to get the employee their credentials, and prove you've done so / get them to someone with a vested interest in assisting that new employee, while maintaining security.
This way you get all that, plus the user has to change their password "on first login" or whatever it's called now, so nothing is compromised.
I've seen systems that handle password changes this way too - forget your password, they email a new (temporary) one to your direct manager.
answered Jul 26 '12 at 21:45
Mark Allen
27926
2
And as long as "I got my credentials but they are not working" are properly followed up on, instead of just regenerated.
– Konerak
May 4 '16 at 11:13
-1 I would say that a manager should never see any of their employees' passwords, even if those passwords will be changed as soon as the employee logs in for the first time. What if, for example, an evil manager logs in as their employee and changes the password to something the employee doesn't know, then blames the employee for not getting work done while locked out of their computer? If the manager never sees the employee's credentials, such a scenario is impossible.
– Kevin
Aug 23 '16 at 21:58
@Kevin I was working under the assumption - as stated in the answer - that the manager has a vested interest in assisting their own employee. If they don't then there are bigger problems than changing ones password.
– Mark Allen
Aug 24 '16 at 23:31
@MarkAllen: If the manager is/was planning on sabotaging the employee/company, they had a large problem...which just got worse!
– jmoreno
Mar 28 at 0:04
add a comment |Â
up vote
17
down vote
Sure, go ahead - as long as the user is required to change the password upon first login. They are, right? I mean, the goal here is to get the employee their credentials, and prove you've done so / get them to someone with a vested interest in assisting that new employee, while maintaining security.
This way you get all that, plus the user has to change their password "on first login" or whatever it's called now, so nothing is compromised.
I've seen systems that handle password changes this way too - forget your password, they email a new (temporary) one to your direct manager.
answered Jul 26 '12 at 21:45
Mark Allen
27926
2
And as long as "I got my credentials but they are not working" are properly followed up on, instead of just regenerated.
– Konerak
May 4 '16 at 11:13
-1 I would say that a manager should never see any of their employees' passwords, even if those passwords will be changed as soon as the employee logs in for the first time. What if, for example, an evil manager logs in as their employee and changes the password to something the employee doesn't know, then blames the employee for not getting work done while locked out of their computer? If the manager never sees the employee's credentials, such a scenario is impossible.
– Kevin
Aug 23 '16 at 21:58
@Kevin I was working under the assumption - as stated in the answer - that the manager has a vested interest in assisting their own employee. If they don't then there are bigger problems than changing ones password.
– Mark Allen
Aug 24 '16 at 23:31
@MarkAllen: If the manager is/was planning on sabotaging the employee/company, they had a large problem...which just got worse!
– jmoreno
Mar 28 at 0:04
add a comment |Â
up vote
17
down vote
up vote
17
down vote
Sure, go ahead - as long as the user is required to change the password upon first login. They are, right? I mean, the goal here is to get the employee their credentials, and prove you've done so / get them to someone with a vested interest in assisting that new employee, while maintaining security.
This way you get all that, plus the user has to change their password "on first login" or whatever it's called now, so nothing is compromised.
I've seen systems that handle password changes this way too - forget your password, they email a new (temporary) one to your direct manager.
answered Jul 26 '12 at 21:45
Mark Allen
27926
Sure, go ahead - as long as the user is required to change the password upon first login. They are, right? I mean, the goal here is to get the employee their credentials, and prove you've done so / get them to someone with a vested interest in assisting that new employee, while maintaining security.
This way you get all that, plus the user has to change their password "on first login" or whatever it's called now, so nothing is compromised.
I've seen systems that handle password changes this way too - forget your password, they email a new (temporary) one to your direct manager.
answered Jul 26 '12 at 21:45
Mark Allen
27926
answered Jul 26 '12 at 21:45
Mark Allen
27926
answered Jul 26 '12 at 21:45
Mark Allen
27926
answered Jul 26 '12 at 21:45
Mark Allen
27926
27926
2
And as long as "I got my credentials but they are not working" are properly followed up on, instead of just regenerated.
– Konerak
May 4 '16 at 11:13
-1 I would say that a manager should never see any of their employees' passwords, even if those passwords will be changed as soon as the employee logs in for the first time. What if, for example, an evil manager logs in as their employee and changes the password to something the employee doesn't know, then blames the employee for not getting work done while locked out of their computer? If the manager never sees the employee's credentials, such a scenario is impossible.
– Kevin
Aug 23 '16 at 21:58
@Kevin I was working under the assumption - as stated in the answer - that the manager has a vested interest in assisting their own employee. If they don't then there are bigger problems than changing ones password.
– Mark Allen
Aug 24 '16 at 23:31
@MarkAllen: If the manager is/was planning on sabotaging the employee/company, they had a large problem...which just got worse!
– jmoreno
Mar 28 at 0:04
add a comment |Â
2
And as long as "I got my credentials but they are not working" are properly followed up on, instead of just regenerated.
– Konerak
May 4 '16 at 11:13
-1 I would say that a manager should never see any of their employees' passwords, even if those passwords will be changed as soon as the employee logs in for the first time. What if, for example, an evil manager logs in as their employee and changes the password to something the employee doesn't know, then blames the employee for not getting work done while locked out of their computer? If the manager never sees the employee's credentials, such a scenario is impossible.
– Kevin
Aug 23 '16 at 21:58
@Kevin I was working under the assumption - as stated in the answer - that the manager has a vested interest in assisting their own employee. If they don't then there are bigger problems than changing ones password.
– Mark Allen
Aug 24 '16 at 23:31
@MarkAllen: If the manager is/was planning on sabotaging the employee/company, they had a large problem...which just got worse!
– jmoreno
Mar 28 at 0:04
2
2
And as long as "I got my credentials but they are not working" are properly followed up on, instead of just regenerated.
– Konerak
May 4 '16 at 11:13
And as long as "I got my credentials but they are not working" are properly followed up on, instead of just regenerated.
– Konerak
May 4 '16 at 11:13
-1 I would say that a manager should never see any of their employees' passwords, even if those passwords will be changed as soon as the employee logs in for the first time. What if, for example, an evil manager logs in as their employee and changes the password to something the employee doesn't know, then blames the employee for not getting work done while locked out of their computer? If the manager never sees the employee's credentials, such a scenario is impossible.
– Kevin
Aug 23 '16 at 21:58
-1 I would say that a manager should never see any of their employees' passwords, even if those passwords will be changed as soon as the employee logs in for the first time. What if, for example, an evil manager logs in as their employee and changes the password to something the employee doesn't know, then blames the employee for not getting work done while locked out of their computer? If the manager never sees the employee's credentials, such a scenario is impossible.
– Kevin
Aug 23 '16 at 21:58
@Kevin I was working under the assumption - as stated in the answer - that the manager has a vested interest in assisting their own employee. If they don't then there are bigger problems than changing ones password.
– Mark Allen
Aug 24 '16 at 23:31
@Kevin I was working under the assumption - as stated in the answer - that the manager has a vested interest in assisting their own employee. If they don't then there are bigger problems than changing ones password.
– Mark Allen
Aug 24 '16 at 23:31
@MarkAllen: If the manager is/was planning on sabotaging the employee/company, they had a large problem...which just got worse!
– jmoreno
Mar 28 at 0:04
@MarkAllen: If the manager is/was planning on sabotaging the employee/company, they had a large problem...which just got worse!
– jmoreno
Mar 28 at 0:04
add a comment |Â
up vote
17
down vote
You can send two emails for this. This is what is followed in our company and the managers never have a problem with it.
To: Employee
Cc: Manager1, Manager2
Dear Employee,
You have been registered in the system. Your username is firstname.lastname.
To adhere to the company's security policies, the password will be sent in the next e-mail marked only to you.
Regards, IT Team
To: Employee
Dear Employee,
The password to the username firstname.lastname is mynewpassword. We request you to change it immediately.
Regards, IT Team
edited Jul 27 '12 at 9:43
gnat
3,23273066
answered Jul 27 '12 at 6:34
Sahil
340412
7
It would seem that including the username and password in the second email negates the point of sending username and password separately!
– Jeromy French
Jan 11 '13 at 19:58
@JeromyFrench: How so? The point is that the second e-mail is sent only to the employee, not to the manager(s). (Sending plain-text passwords by e-mail is another issue, which is discussed by the other answers.)
– Keith Thompson
Jan 12 '13 at 1:39
3
Jeromy is right. Seding both the username and the password in the second email means a) anyone intercepting that email can login to the account b) the first email is pointless. The second email should read "the password of your recently created account is 'mynewpassword'"
– DJClayworth
Jan 14 '13 at 14:56
7
How is the employee going to receive the password if he can not log in to the system to get his email?
– IDrinkandIKnowThings
Jan 14 '13 at 15:00
@DJClayworth The first email is not pointless. Although the employee receives the actual login name twice, it means that everyone knows that the login has been set up, everyone knows that everyone else knows that, and everyone knows that noone has the password except the employee.
– Julia Hayward
May 4 '16 at 9:53
add a comment |Â
up vote
17
down vote
You can send two emails for this. This is what is followed in our company and the managers never have a problem with it.
To: Employee
Cc: Manager1, Manager2
Dear Employee,
You have been registered in the system. Your username is firstname.lastname.
To adhere to the company's security policies, the password will be sent in the next e-mail marked only to you.
Regards, IT Team
To: Employee
Dear Employee,
The password to the username firstname.lastname is mynewpassword. We request you to change it immediately.
Regards, IT Team
edited Jul 27 '12 at 9:43
gnat
3,23273066
answered Jul 27 '12 at 6:34
Sahil
340412
7
It would seem that including the username and password in the second email negates the point of sending username and password separately!
– Jeromy French
Jan 11 '13 at 19:58
@JeromyFrench: How so? The point is that the second e-mail is sent only to the employee, not to the manager(s). (Sending plain-text passwords by e-mail is another issue, which is discussed by the other answers.)
– Keith Thompson
Jan 12 '13 at 1:39
3
Jeromy is right. Seding both the username and the password in the second email means a) anyone intercepting that email can login to the account b) the first email is pointless. The second email should read "the password of your recently created account is 'mynewpassword'"
– DJClayworth
Jan 14 '13 at 14:56
7
How is the employee going to receive the password if he can not log in to the system to get his email?
– IDrinkandIKnowThings
Jan 14 '13 at 15:00
@DJClayworth The first email is not pointless. Although the employee receives the actual login name twice, it means that everyone knows that the login has been set up, everyone knows that everyone else knows that, and everyone knows that noone has the password except the employee.
– Julia Hayward
May 4 '16 at 9:53
add a comment |Â
up vote
17
down vote
up vote
17
down vote
You can send two emails for this. This is what is followed in our company and the managers never have a problem with it.
To: Employee
Cc: Manager1, Manager2
Dear Employee,
You have been registered in the system. Your username is firstname.lastname.
To adhere to the company's security policies, the password will be sent in the next e-mail marked only to you.
Regards, IT Team
To: Employee
Dear Employee,
The password to the username firstname.lastname is mynewpassword. We request you to change it immediately.
Regards, IT Team
edited Jul 27 '12 at 9:43
gnat
3,23273066
answered Jul 27 '12 at 6:34
Sahil
340412
You can send two emails for this. This is what is followed in our company and the managers never have a problem with it.
To: Employee
Cc: Manager1, Manager2
Dear Employee,
You have been registered in the system. Your username is firstname.lastname.
To adhere to the company's security policies, the password will be sent in the next e-mail marked only to you.
Regards, IT Team
To: Employee
Dear Employee,
The password to the username firstname.lastname is mynewpassword. We request you to change it immediately.
Regards, IT Team
edited Jul 27 '12 at 9:43
gnat
3,23273066
answered Jul 27 '12 at 6:34
Sahil
340412
edited Jul 27 '12 at 9:43
gnat
3,23273066
edited Jul 27 '12 at 9:43
gnat
3,23273066
edited Jul 27 '12 at 9:43
gnat
3,23273066
3,23273066
answered Jul 27 '12 at 6:34
Sahil
340412
answered Jul 27 '12 at 6:34
Sahil
340412
answered Jul 27 '12 at 6:34
Sahil
340412
340412
7
It would seem that including the username and password in the second email negates the point of sending username and password separately!
– Jeromy French
Jan 11 '13 at 19:58
@JeromyFrench: How so? The point is that the second e-mail is sent only to the employee, not to the manager(s). (Sending plain-text passwords by e-mail is another issue, which is discussed by the other answers.)
– Keith Thompson
Jan 12 '13 at 1:39
3
Jeromy is right. Seding both the username and the password in the second email means a) anyone intercepting that email can login to the account b) the first email is pointless. The second email should read "the password of your recently created account is 'mynewpassword'"
– DJClayworth
Jan 14 '13 at 14:56
7
How is the employee going to receive the password if he can not log in to the system to get his email?
– IDrinkandIKnowThings
Jan 14 '13 at 15:00
@DJClayworth The first email is not pointless. Although the employee receives the actual login name twice, it means that everyone knows that the login has been set up, everyone knows that everyone else knows that, and everyone knows that noone has the password except the employee.
– Julia Hayward
May 4 '16 at 9:53
add a comment |Â
7
It would seem that including the username and password in the second email negates the point of sending username and password separately!
– Jeromy French
Jan 11 '13 at 19:58
@JeromyFrench: How so? The point is that the second e-mail is sent only to the employee, not to the manager(s). (Sending plain-text passwords by e-mail is another issue, which is discussed by the other answers.)
– Keith Thompson
Jan 12 '13 at 1:39
3
Jeromy is right. Seding both the username and the password in the second email means a) anyone intercepting that email can login to the account b) the first email is pointless. The second email should read "the password of your recently created account is 'mynewpassword'"
– DJClayworth
Jan 14 '13 at 14:56
7
How is the employee going to receive the password if he can not log in to the system to get his email?
– IDrinkandIKnowThings
Jan 14 '13 at 15:00
@DJClayworth The first email is not pointless. Although the employee receives the actual login name twice, it means that everyone knows that the login has been set up, everyone knows that everyone else knows that, and everyone knows that noone has the password except the employee.
– Julia Hayward
May 4 '16 at 9:53
7
7
It would seem that including the username and password in the second email negates the point of sending username and password separately!
– Jeromy French
Jan 11 '13 at 19:58
It would seem that including the username and password in the second email negates the point of sending username and password separately!
– Jeromy French
Jan 11 '13 at 19:58
@JeromyFrench: How so? The point is that the second e-mail is sent only to the employee, not to the manager(s). (Sending plain-text passwords by e-mail is another issue, which is discussed by the other answers.)
– Keith Thompson
Jan 12 '13 at 1:39
@JeromyFrench: How so? The point is that the second e-mail is sent only to the employee, not to the manager(s). (Sending plain-text passwords by e-mail is another issue, which is discussed by the other answers.)
– Keith Thompson
Jan 12 '13 at 1:39
3
3
Jeromy is right. Seding both the username and the password in the second email means a) anyone intercepting that email can login to the account b) the first email is pointless. The second email should read "the password of your recently created account is 'mynewpassword'"
– DJClayworth
Jan 14 '13 at 14:56
Jeromy is right. Seding both the username and the password in the second email means a) anyone intercepting that email can login to the account b) the first email is pointless. The second email should read "the password of your recently created account is 'mynewpassword'"
– DJClayworth
Jan 14 '13 at 14:56
7
7
How is the employee going to receive the password if he can not log in to the system to get his email?
– IDrinkandIKnowThings
Jan 14 '13 at 15:00
How is the employee going to receive the password if he can not log in to the system to get his email?
– IDrinkandIKnowThings
Jan 14 '13 at 15:00
@DJClayworth The first email is not pointless. Although the employee receives the actual login name twice, it means that everyone knows that the login has been set up, everyone knows that everyone else knows that, and everyone knows that noone has the password except the employee.
– Julia Hayward
May 4 '16 at 9:53
@DJClayworth The first email is not pointless. Although the employee receives the actual login name twice, it means that everyone knows that the login has been set up, everyone knows that everyone else knows that, and everyone knows that noone has the password except the employee.
– Julia Hayward
May 4 '16 at 9:53
add a comment |Â
up vote
14
down vote
While it's appropriate to send a password via email, that password must be temporary; upon first login, the system must force a password change. Most enterprise-grade products support this option.
The problem is that credentials should not be stored anywhere in the open -- email least of all, since that's the first place attackers will look. Sending the password in a separate email doesn't really help, since a hacker who gets into your email will be able to see both messages, so you're no safer that way. Also, you may be required by a manager or anyone else for that matter to copy them on emails like this, significantly increasing your attack surface and the likelihood of an attacker getting the password.
The best solution is to simply force the user to change his password. Do not request that that the user change his password, since he never will. There are thousands of accounts out there with the password 12345 which was assigned as a temporary password and which the user was requested to change... and which he never did change.
answered Jul 27 '12 at 9:11
tylerl
24115
+1 for mentioning the industry-condoned practice of communicating the login credentials.
– Jas
May 4 '16 at 8:04
add a comment |Â
up vote
14
down vote
While it's appropriate to send a password via email, that password must be temporary; upon first login, the system must force a password change. Most enterprise-grade products support this option.
The problem is that credentials should not be stored anywhere in the open -- email least of all, since that's the first place attackers will look. Sending the password in a separate email doesn't really help, since a hacker who gets into your email will be able to see both messages, so you're no safer that way. Also, you may be required by a manager or anyone else for that matter to copy them on emails like this, significantly increasing your attack surface and the likelihood of an attacker getting the password.
The best solution is to simply force the user to change his password. Do not request that that the user change his password, since he never will. There are thousands of accounts out there with the password 12345 which was assigned as a temporary password and which the user was requested to change... and which he never did change.
answered Jul 27 '12 at 9:11
tylerl
24115
+1 for mentioning the industry-condoned practice of communicating the login credentials.
– Jas
May 4 '16 at 8:04
add a comment |Â
up vote
14
down vote
up vote
14
down vote
While it's appropriate to send a password via email, that password must be temporary; upon first login, the system must force a password change. Most enterprise-grade products support this option.
The problem is that credentials should not be stored anywhere in the open -- email least of all, since that's the first place attackers will look. Sending the password in a separate email doesn't really help, since a hacker who gets into your email will be able to see both messages, so you're no safer that way. Also, you may be required by a manager or anyone else for that matter to copy them on emails like this, significantly increasing your attack surface and the likelihood of an attacker getting the password.
The best solution is to simply force the user to change his password. Do not request that that the user change his password, since he never will. There are thousands of accounts out there with the password 12345 which was assigned as a temporary password and which the user was requested to change... and which he never did change.
answered Jul 27 '12 at 9:11
tylerl
24115
While it's appropriate to send a password via email, that password must be temporary; upon first login, the system must force a password change. Most enterprise-grade products support this option.
The problem is that credentials should not be stored anywhere in the open -- email least of all, since that's the first place attackers will look. Sending the password in a separate email doesn't really help, since a hacker who gets into your email will be able to see both messages, so you're no safer that way. Also, you may be required by a manager or anyone else for that matter to copy them on emails like this, significantly increasing your attack surface and the likelihood of an attacker getting the password.
The best solution is to simply force the user to change his password. Do not request that that the user change his password, since he never will. There are thousands of accounts out there with the password 12345 which was assigned as a temporary password and which the user was requested to change... and which he never did change.
answered Jul 27 '12 at 9:11
tylerl
24115
answered Jul 27 '12 at 9:11
tylerl
24115
answered Jul 27 '12 at 9:11
tylerl
24115
answered Jul 27 '12 at 9:11
tylerl
24115
24115
+1 for mentioning the industry-condoned practice of communicating the login credentials.
– Jas
May 4 '16 at 8:04
add a comment |Â
+1 for mentioning the industry-condoned practice of communicating the login credentials.
– Jas
May 4 '16 at 8:04
+1 for mentioning the industry-condoned practice of communicating the login credentials.
– Jas
May 4 '16 at 8:04
+1 for mentioning the industry-condoned practice of communicating the login credentials.
– Jas
May 4 '16 at 8:04
add a comment |Â
up vote
10
down vote
NO! it is not - this is security and sysadmin 101.
Also you do not ever send the user name and password in the clear, in the same document. Best practice is to create a temp password and communicate this to the employee via some other method and have the user change the password on login.
edited Jan 14 '13 at 13:24
alroc
12.8k23954
answered Jul 27 '12 at 14:20
Neuro
467512
add a comment |Â
up vote
10
down vote
NO! it is not - this is security and sysadmin 101.
Also you do not ever send the user name and password in the clear, in the same document. Best practice is to create a temp password and communicate this to the employee via some other method and have the user change the password on login.
edited Jan 14 '13 at 13:24
alroc
12.8k23954
answered Jul 27 '12 at 14:20
Neuro
467512
add a comment |Â
up vote
10
down vote
up vote
10
down vote
NO! it is not - this is security and sysadmin 101.
Also you do not ever send the user name and password in the clear, in the same document. Best practice is to create a temp password and communicate this to the employee via some other method and have the user change the password on login.
edited Jan 14 '13 at 13:24
alroc
12.8k23954
answered Jul 27 '12 at 14:20
Neuro
467512
NO! it is not - this is security and sysadmin 101.
Also you do not ever send the user name and password in the clear, in the same document. Best practice is to create a temp password and communicate this to the employee via some other method and have the user change the password on login.
edited Jan 14 '13 at 13:24
alroc
12.8k23954
answered Jul 27 '12 at 14:20
Neuro
467512
edited Jan 14 '13 at 13:24
alroc
12.8k23954
edited Jan 14 '13 at 13:24
alroc
12.8k23954
edited Jan 14 '13 at 13:24
alroc
12.8k23954
12.8k23954
answered Jul 27 '12 at 14:20
Neuro
467512
answered Jul 27 '12 at 14:20
Neuro
467512
answered Jul 27 '12 at 14:20
Neuro
467512
467512
add a comment |Â
add a comment |Â
up vote
5
down vote
No, the password should not even be in the email in the first place. At my place of work, one tells the login ID to a user and requests the user to call IT to obtain a temporary password.
There are some other security considerations to think about.
If your company has the robust technology to support it, passwords should be hashed using a strong algorithm.
The email itself should be sent encrypted.
Avoid using SSL and early version TLS as the encryption method as these are longer considered secure.
AES can be used to encrypt symmetrically or a algorithm like RSA can be used to encrypt asymmetrically (2 keys)Secure emails with sensitive information should be digitally signed so that the recipient can verify the authenticity of the sender and to ensure non - repudiation by the sender.
A one way hash function such as HMAC-SHA 256 is applied to transform email into a cryptographic message digest. Do not sign using the SHA 1 algorithm as such algorithm has been cryptographically broken and is no longer secure as a result. Using PKI, a private key only you know is used to encrypt. Once the receiver uses your public key to decrypt, the resulting message hash should be the same. The public key is protected from tampering by a certificate that binds the identity of the owner with his / her public key. The certificate is obtained via a CA upon validating the credentials you supplied in your certificate request.
Otherwise, message integrity is lost and the received message cannot be trusted to be the message you sent.
The private key is known only to the sender and is associated with a unique public key known to the receiver of the email. By the fact that the receiver is able to use the public key associated with the sender of the email to decrypt the email message, means that the sender cannot deny having sent the message>>
Point 2 ensures that the Confidentiality of the email is not compromised. Confidentiality means no unauthorized disclosure occurred such as through MITM.
Point 3 ensures integrity and non - repudiation or that the contents of the email has not been altered by an unauthorized party, and that sender of the email cannot deny having sent the email, due to the presence of his or her public key used to decrypt the message by the receiver of the email.
Finally, you can mask the data when displayed for extra security.
answered May 4 '16 at 23:23
Anthony
5,2391355
This should be the accepted answer. See also this security.SE question and answer.
– shoover
May 5 '16 at 15:26
add a comment |Â
up vote
5
down vote
No, the password should not even be in the email in the first place. At my place of work, one tells the login ID to a user and requests the user to call IT to obtain a temporary password.
There are some other security considerations to think about.
If your company has the robust technology to support it, passwords should be hashed using a strong algorithm.
The email itself should be sent encrypted.
Avoid using SSL and early version TLS as the encryption method as these are longer considered secure.
AES can be used to encrypt symmetrically or a algorithm like RSA can be used to encrypt asymmetrically (2 keys)Secure emails with sensitive information should be digitally signed so that the recipient can verify the authenticity of the sender and to ensure non - repudiation by the sender.
A one way hash function such as HMAC-SHA 256 is applied to transform email into a cryptographic message digest. Do not sign using the SHA 1 algorithm as such algorithm has been cryptographically broken and is no longer secure as a result. Using PKI, a private key only you know is used to encrypt. Once the receiver uses your public key to decrypt, the resulting message hash should be the same. The public key is protected from tampering by a certificate that binds the identity of the owner with his / her public key. The certificate is obtained via a CA upon validating the credentials you supplied in your certificate request.
Otherwise, message integrity is lost and the received message cannot be trusted to be the message you sent.
The private key is known only to the sender and is associated with a unique public key known to the receiver of the email. By the fact that the receiver is able to use the public key associated with the sender of the email to decrypt the email message, means that the sender cannot deny having sent the message>>
Point 2 ensures that the Confidentiality of the email is not compromised. Confidentiality means no unauthorized disclosure occurred such as through MITM.
Point 3 ensures integrity and non - repudiation or that the contents of the email has not been altered by an unauthorized party, and that sender of the email cannot deny having sent the email, due to the presence of his or her public key used to decrypt the message by the receiver of the email.
Finally, you can mask the data when displayed for extra security.
answered May 4 '16 at 23:23
Anthony
5,2391355
This should be the accepted answer. See also this security.SE question and answer.
– shoover
May 5 '16 at 15:26
add a comment |Â
up vote
5
down vote
up vote
5
down vote
No, the password should not even be in the email in the first place. At my place of work, one tells the login ID to a user and requests the user to call IT to obtain a temporary password.
There are some other security considerations to think about.
If your company has the robust technology to support it, passwords should be hashed using a strong algorithm.
The email itself should be sent encrypted.
Avoid using SSL and early version TLS as the encryption method as these are longer considered secure.
AES can be used to encrypt symmetrically or a algorithm like RSA can be used to encrypt asymmetrically (2 keys)Secure emails with sensitive information should be digitally signed so that the recipient can verify the authenticity of the sender and to ensure non - repudiation by the sender.
A one way hash function such as HMAC-SHA 256 is applied to transform email into a cryptographic message digest. Do not sign using the SHA 1 algorithm as such algorithm has been cryptographically broken and is no longer secure as a result. Using PKI, a private key only you know is used to encrypt. Once the receiver uses your public key to decrypt, the resulting message hash should be the same. The public key is protected from tampering by a certificate that binds the identity of the owner with his / her public key. The certificate is obtained via a CA upon validating the credentials you supplied in your certificate request.
Otherwise, message integrity is lost and the received message cannot be trusted to be the message you sent.
The private key is known only to the sender and is associated with a unique public key known to the receiver of the email. By the fact that the receiver is able to use the public key associated with the sender of the email to decrypt the email message, means that the sender cannot deny having sent the message>>
Point 2 ensures that the Confidentiality of the email is not compromised. Confidentiality means no unauthorized disclosure occurred such as through MITM.
Point 3 ensures integrity and non - repudiation or that the contents of the email has not been altered by an unauthorized party, and that sender of the email cannot deny having sent the email, due to the presence of his or her public key used to decrypt the message by the receiver of the email.
Finally, you can mask the data when displayed for extra security.
answered May 4 '16 at 23:23
Anthony
5,2391355
No, the password should not even be in the email in the first place. At my place of work, one tells the login ID to a user and requests the user to call IT to obtain a temporary password.
There are some other security considerations to think about.
If your company has the robust technology to support it, passwords should be hashed using a strong algorithm.
The email itself should be sent encrypted.
Avoid using SSL and early version TLS as the encryption method as these are longer considered secure.
AES can be used to encrypt symmetrically or a algorithm like RSA can be used to encrypt asymmetrically (2 keys)Secure emails with sensitive information should be digitally signed so that the recipient can verify the authenticity of the sender and to ensure non - repudiation by the sender.
A one way hash function such as HMAC-SHA 256 is applied to transform email into a cryptographic message digest. Do not sign using the SHA 1 algorithm as such algorithm has been cryptographically broken and is no longer secure as a result. Using PKI, a private key only you know is used to encrypt. Once the receiver uses your public key to decrypt, the resulting message hash should be the same. The public key is protected from tampering by a certificate that binds the identity of the owner with his / her public key. The certificate is obtained via a CA upon validating the credentials you supplied in your certificate request.
Otherwise, message integrity is lost and the received message cannot be trusted to be the message you sent.
The private key is known only to the sender and is associated with a unique public key known to the receiver of the email. By the fact that the receiver is able to use the public key associated with the sender of the email to decrypt the email message, means that the sender cannot deny having sent the message>>
Point 2 ensures that the Confidentiality of the email is not compromised. Confidentiality means no unauthorized disclosure occurred such as through MITM.
Point 3 ensures integrity and non - repudiation or that the contents of the email has not been altered by an unauthorized party, and that sender of the email cannot deny having sent the email, due to the presence of his or her public key used to decrypt the message by the receiver of the email.
Finally, you can mask the data when displayed for extra security.
answered May 4 '16 at 23:23
Anthony
5,2391355
edited Jan 4 at 17:50
answered May 4 '16 at 23:23
Anthony
5,2391355
answered May 4 '16 at 23:23
Anthony
5,2391355
answered May 4 '16 at 23:23
Anthony
5,2391355
5,2391355
This should be the accepted answer. See also this security.SE question and answer.
– shoover
May 5 '16 at 15:26
add a comment |Â
This should be the accepted answer. See also this security.SE question and answer.
– shoover
May 5 '16 at 15:26
This should be the accepted answer. See also this security.SE question and answer.
– shoover
May 5 '16 at 15:26
This should be the accepted answer. See also this security.SE question and answer.
– shoover
May 5 '16 at 15:26
add a comment |Â
up vote
4
down vote
If you're asking this, then you're in IT. ask your boss what company policy is. That's the safest path. Otherwise, I'd be inclined to say no, do not give managers the credentials.
However, ALWAYS let the manager know that a logon has been created for their underling. If they then request the credentials, ask them to submit that via your boss, so that it goes through proper channels.
answered Jul 26 '12 at 20:40
acolyte
3,0531632
3
If they're requesting the credentials, something is majorly wrong.
– jmort253♦
Jul 26 '12 at 23:10
@jmort253 not neccessarily. generally, it's not good. but in some cases it's fine. case-by-case basis. after all, if the employee is sick, and was supposed to give a presentation, the boss might request access to employee's machine to pull up relavent files in order to give presentation themself
– acolyte
Jul 27 '12 at 5:07
2
Then that's a risk that should be factored in. Bob shouldn't be the only person to have access to the files. The manager should be able to use his/her own login to access the system. As Oded says, the whole point of authentication is to verify that the person accessing a resource is who he/she says he is. For instance, that's why Google Docs has a sharing feature, so I don't have to give you access to all my stuff. In this case, the something that's majorly wrong is the lack of planning on the part of the employee, manager, and IT department.
– jmort253♦
Jul 27 '12 at 7:24
add a comment |Â
up vote
4
down vote
If you're asking this, then you're in IT. ask your boss what company policy is. That's the safest path. Otherwise, I'd be inclined to say no, do not give managers the credentials.
However, ALWAYS let the manager know that a logon has been created for their underling. If they then request the credentials, ask them to submit that via your boss, so that it goes through proper channels.
answered Jul 26 '12 at 20:40
acolyte
3,0531632
3
If they're requesting the credentials, something is majorly wrong.
– jmort253♦
Jul 26 '12 at 23:10
@jmort253 not neccessarily. generally, it's not good. but in some cases it's fine. case-by-case basis. after all, if the employee is sick, and was supposed to give a presentation, the boss might request access to employee's machine to pull up relavent files in order to give presentation themself
– acolyte
Jul 27 '12 at 5:07
2
Then that's a risk that should be factored in. Bob shouldn't be the only person to have access to the files. The manager should be able to use his/her own login to access the system. As Oded says, the whole point of authentication is to verify that the person accessing a resource is who he/she says he is. For instance, that's why Google Docs has a sharing feature, so I don't have to give you access to all my stuff. In this case, the something that's majorly wrong is the lack of planning on the part of the employee, manager, and IT department.
– jmort253♦
Jul 27 '12 at 7:24
add a comment |Â
up vote
4
down vote
up vote
4
down vote
If you're asking this, then you're in IT. ask your boss what company policy is. That's the safest path. Otherwise, I'd be inclined to say no, do not give managers the credentials.
However, ALWAYS let the manager know that a logon has been created for their underling. If they then request the credentials, ask them to submit that via your boss, so that it goes through proper channels.
answered Jul 26 '12 at 20:40
acolyte
3,0531632
If you're asking this, then you're in IT. ask your boss what company policy is. That's the safest path. Otherwise, I'd be inclined to say no, do not give managers the credentials.
However, ALWAYS let the manager know that a logon has been created for their underling. If they then request the credentials, ask them to submit that via your boss, so that it goes through proper channels.
answered Jul 26 '12 at 20:40
acolyte
3,0531632
answered Jul 26 '12 at 20:40
acolyte
3,0531632
answered Jul 26 '12 at 20:40
acolyte
3,0531632
answered Jul 26 '12 at 20:40
acolyte
3,0531632
3,0531632
3
If they're requesting the credentials, something is majorly wrong.
– jmort253♦
Jul 26 '12 at 23:10
@jmort253 not neccessarily. generally, it's not good. but in some cases it's fine. case-by-case basis. after all, if the employee is sick, and was supposed to give a presentation, the boss might request access to employee's machine to pull up relavent files in order to give presentation themself
– acolyte
Jul 27 '12 at 5:07
2
Then that's a risk that should be factored in. Bob shouldn't be the only person to have access to the files. The manager should be able to use his/her own login to access the system. As Oded says, the whole point of authentication is to verify that the person accessing a resource is who he/she says he is. For instance, that's why Google Docs has a sharing feature, so I don't have to give you access to all my stuff. In this case, the something that's majorly wrong is the lack of planning on the part of the employee, manager, and IT department.
– jmort253♦
Jul 27 '12 at 7:24
add a comment |Â
3
If they're requesting the credentials, something is majorly wrong.
– jmort253♦
Jul 26 '12 at 23:10
@jmort253 not neccessarily. generally, it's not good. but in some cases it's fine. case-by-case basis. after all, if the employee is sick, and was supposed to give a presentation, the boss might request access to employee's machine to pull up relavent files in order to give presentation themself
– acolyte
Jul 27 '12 at 5:07
2
Then that's a risk that should be factored in. Bob shouldn't be the only person to have access to the files. The manager should be able to use his/her own login to access the system. As Oded says, the whole point of authentication is to verify that the person accessing a resource is who he/she says he is. For instance, that's why Google Docs has a sharing feature, so I don't have to give you access to all my stuff. In this case, the something that's majorly wrong is the lack of planning on the part of the employee, manager, and IT department.
– jmort253♦
Jul 27 '12 at 7:24
3
3
If they're requesting the credentials, something is majorly wrong.
– jmort253♦
Jul 26 '12 at 23:10
If they're requesting the credentials, something is majorly wrong.
– jmort253♦
Jul 26 '12 at 23:10
@jmort253 not neccessarily. generally, it's not good. but in some cases it's fine. case-by-case basis. after all, if the employee is sick, and was supposed to give a presentation, the boss might request access to employee's machine to pull up relavent files in order to give presentation themself
– acolyte
Jul 27 '12 at 5:07
@jmort253 not neccessarily. generally, it's not good. but in some cases it's fine. case-by-case basis. after all, if the employee is sick, and was supposed to give a presentation, the boss might request access to employee's machine to pull up relavent files in order to give presentation themself
– acolyte
Jul 27 '12 at 5:07
2
2
Then that's a risk that should be factored in. Bob shouldn't be the only person to have access to the files. The manager should be able to use his/her own login to access the system. As Oded says, the whole point of authentication is to verify that the person accessing a resource is who he/she says he is. For instance, that's why Google Docs has a sharing feature, so I don't have to give you access to all my stuff. In this case, the something that's majorly wrong is the lack of planning on the part of the employee, manager, and IT department.
– jmort253♦
Jul 27 '12 at 7:24
Then that's a risk that should be factored in. Bob shouldn't be the only person to have access to the files. The manager should be able to use his/her own login to access the system. As Oded says, the whole point of authentication is to verify that the person accessing a resource is who he/she says he is. For instance, that's why Google Docs has a sharing feature, so I don't have to give you access to all my stuff. In this case, the something that's majorly wrong is the lack of planning on the part of the employee, manager, and IT department.
– jmort253♦
Jul 27 '12 at 7:24
add a comment |Â
up vote
3
down vote
I deal with this regularly.
This is my best solution so far:
- I have created a small script that creates the user account, sets the password (I pull from dinopass.com, but whatever you want), and assigns the user to their job role (active directory group). The password is set to require reset at the first login.
- The script then generates a text file with the user's login and password. It also includes simple instructions for logging on, and the support desk phone / extension.
- I PRINT the text file (ordinarily I hate printing, but in this case, yes), put the printout in a sealed envelope with the new employee's name on it, and give that to the manager.
Obviously this may not work if your organization is so large that you have multiple campuses, but this method:
- Secures the password from "nosy" coworkers.
- Forces the password to be reset on first logon.
- Clearly communicates to the manager that the task is done.
- Helps establish that the employee's first line of inquiry is to their manager, not to the help desk.
Obviously this works well in a single-building environment, but it does work very well for me. It also lets my front-line techs handle things easily, as I just give them the script (C# Console App that asks for user's first/last name, and pick employee role).
Hope it helps you.
answered May 4 '16 at 22:20
Wesley Long
45.1k15100162
add a comment |Â
up vote
3
down vote
I deal with this regularly.
This is my best solution so far:
- I have created a small script that creates the user account, sets the password (I pull from dinopass.com, but whatever you want), and assigns the user to their job role (active directory group). The password is set to require reset at the first login.
- The script then generates a text file with the user's login and password. It also includes simple instructions for logging on, and the support desk phone / extension.
- I PRINT the text file (ordinarily I hate printing, but in this case, yes), put the printout in a sealed envelope with the new employee's name on it, and give that to the manager.
Obviously this may not work if your organization is so large that you have multiple campuses, but this method:
- Secures the password from "nosy" coworkers.
- Forces the password to be reset on first logon.
- Clearly communicates to the manager that the task is done.
- Helps establish that the employee's first line of inquiry is to their manager, not to the help desk.
Obviously this works well in a single-building environment, but it does work very well for me. It also lets my front-line techs handle things easily, as I just give them the script (C# Console App that asks for user's first/last name, and pick employee role).
Hope it helps you.
answered May 4 '16 at 22:20
Wesley Long
45.1k15100162
add a comment |Â
up vote
3
down vote
up vote
3
down vote
I deal with this regularly.
This is my best solution so far:
- I have created a small script that creates the user account, sets the password (I pull from dinopass.com, but whatever you want), and assigns the user to their job role (active directory group). The password is set to require reset at the first login.
- The script then generates a text file with the user's login and password. It also includes simple instructions for logging on, and the support desk phone / extension.
- I PRINT the text file (ordinarily I hate printing, but in this case, yes), put the printout in a sealed envelope with the new employee's name on it, and give that to the manager.
Obviously this may not work if your organization is so large that you have multiple campuses, but this method:
- Secures the password from "nosy" coworkers.
- Forces the password to be reset on first logon.
- Clearly communicates to the manager that the task is done.
- Helps establish that the employee's first line of inquiry is to their manager, not to the help desk.
Obviously this works well in a single-building environment, but it does work very well for me. It also lets my front-line techs handle things easily, as I just give them the script (C# Console App that asks for user's first/last name, and pick employee role).
Hope it helps you.
answered May 4 '16 at 22:20
Wesley Long
45.1k15100162
I deal with this regularly.
This is my best solution so far:
- I have created a small script that creates the user account, sets the password (I pull from dinopass.com, but whatever you want), and assigns the user to their job role (active directory group). The password is set to require reset at the first login.
- The script then generates a text file with the user's login and password. It also includes simple instructions for logging on, and the support desk phone / extension.
- I PRINT the text file (ordinarily I hate printing, but in this case, yes), put the printout in a sealed envelope with the new employee's name on it, and give that to the manager.
Obviously this may not work if your organization is so large that you have multiple campuses, but this method:
- Secures the password from "nosy" coworkers.
- Forces the password to be reset on first logon.
- Clearly communicates to the manager that the task is done.
- Helps establish that the employee's first line of inquiry is to their manager, not to the help desk.
Obviously this works well in a single-building environment, but it does work very well for me. It also lets my front-line techs handle things easily, as I just give them the script (C# Console App that asks for user's first/last name, and pick employee role).
Hope it helps you.
answered May 4 '16 at 22:20
Wesley Long
45.1k15100162
answered May 4 '16 at 22:20
Wesley Long
45.1k15100162
answered May 4 '16 at 22:20
Wesley Long
45.1k15100162
answered May 4 '16 at 22:20
Wesley Long
45.1k15100162
45.1k15100162
add a comment |Â
add a comment |Â
up vote
1
down vote
If you are located near the new employees you can have them pickup a hard copy of the login information. You will just need to let the manager know that it is ready.
If there is a great distance between you and the employees, you will have to email the manger the credentials. This is to let them give the credentials to the new employee.
I worked for a place that tried to tell you to pickup the passwords by leaving a voice mail. They also sent you an email to tell you your voice mail was now enabled. Needless to say that method didn't work very well for new employees.
I also sent credentials to a manger once because the employee wouldn't try to login. They told their manager they never got them. After 4 or 5 cycles of creating a new temporary password and sending it out, they miraculously arrived after I also sent them to the manager.
answered Jul 26 '12 at 19:45
mhoran_psprep
40.3k463144
add a comment |Â
up vote
1
down vote
If you are located near the new employees you can have them pickup a hard copy of the login information. You will just need to let the manager know that it is ready.
If there is a great distance between you and the employees, you will have to email the manger the credentials. This is to let them give the credentials to the new employee.
I worked for a place that tried to tell you to pickup the passwords by leaving a voice mail. They also sent you an email to tell you your voice mail was now enabled. Needless to say that method didn't work very well for new employees.
I also sent credentials to a manger once because the employee wouldn't try to login. They told their manager they never got them. After 4 or 5 cycles of creating a new temporary password and sending it out, they miraculously arrived after I also sent them to the manager.
answered Jul 26 '12 at 19:45
mhoran_psprep
40.3k463144
add a comment |Â
up vote
1
down vote
up vote
1
down vote
If you are located near the new employees you can have them pickup a hard copy of the login information. You will just need to let the manager know that it is ready.
If there is a great distance between you and the employees, you will have to email the manger the credentials. This is to let them give the credentials to the new employee.
I worked for a place that tried to tell you to pickup the passwords by leaving a voice mail. They also sent you an email to tell you your voice mail was now enabled. Needless to say that method didn't work very well for new employees.
I also sent credentials to a manger once because the employee wouldn't try to login. They told their manager they never got them. After 4 or 5 cycles of creating a new temporary password and sending it out, they miraculously arrived after I also sent them to the manager.
answered Jul 26 '12 at 19:45
mhoran_psprep
40.3k463144
If you are located near the new employees you can have them pickup a hard copy of the login information. You will just need to let the manager know that it is ready.
If there is a great distance between you and the employees, you will have to email the manger the credentials. This is to let them give the credentials to the new employee.
I worked for a place that tried to tell you to pickup the passwords by leaving a voice mail. They also sent you an email to tell you your voice mail was now enabled. Needless to say that method didn't work very well for new employees.
I also sent credentials to a manger once because the employee wouldn't try to login. They told their manager they never got them. After 4 or 5 cycles of creating a new temporary password and sending it out, they miraculously arrived after I also sent them to the manager.
answered Jul 26 '12 at 19:45
mhoran_psprep
40.3k463144
answered Jul 26 '12 at 19:45
mhoran_psprep
40.3k463144
answered Jul 26 '12 at 19:45
mhoran_psprep
40.3k463144
answered Jul 26 '12 at 19:45
mhoran_psprep
40.3k463144
40.3k463144
add a comment |Â
add a comment |Â
up vote
0
down vote
A solution I've used, but didn't see suggested: Send the new user an email letting them know their account has been set up. If cc'ing their manager seems appropriate or necessary, then do so. However, you send them your telephone number and have them call (or visit) you to get their credentials. Or, you might send them their login id in this email; however, do not send the password via email.
answered Jan 11 '13 at 19:48
GreenMatt
15.6k1465109
add a comment |Â
up vote
0
down vote
A solution I've used, but didn't see suggested: Send the new user an email letting them know their account has been set up. If cc'ing their manager seems appropriate or necessary, then do so. However, you send them your telephone number and have them call (or visit) you to get their credentials. Or, you might send them their login id in this email; however, do not send the password via email.
answered Jan 11 '13 at 19:48
GreenMatt
15.6k1465109
add a comment |Â
up vote
0
down vote
up vote
0
down vote
A solution I've used, but didn't see suggested: Send the new user an email letting them know their account has been set up. If cc'ing their manager seems appropriate or necessary, then do so. However, you send them your telephone number and have them call (or visit) you to get their credentials. Or, you might send them their login id in this email; however, do not send the password via email.
answered Jan 11 '13 at 19:48
GreenMatt
15.6k1465109
A solution I've used, but didn't see suggested: Send the new user an email letting them know their account has been set up. If cc'ing their manager seems appropriate or necessary, then do so. However, you send them your telephone number and have them call (or visit) you to get their credentials. Or, you might send them their login id in this email; however, do not send the password via email.
answered Jan 11 '13 at 19:48
GreenMatt
15.6k1465109
edited Jan 14 '13 at 12:07
answered Jan 11 '13 at 19:48
GreenMatt
15.6k1465109
answered Jan 11 '13 at 19:48
GreenMatt
15.6k1465109
answered Jan 11 '13 at 19:48
GreenMatt
15.6k1465109
15.6k1465109
add a comment |Â
add a comment |Â
up vote
0
down vote
Imagine some criminal damage is done, with incontrovertible evidence that it was done by someone having that person's username and password. Now you have a problem. There are two people, and you are quite sure that one is a criminal and one is quite innocent. Your company has a big problem. In Europe you have a huge problem because you know someone caused criminal damage and you can't fire them. In the USA, you still have a huge problem because there are two persons that you could fire, but one of them is totally innocent and you would lose what is likely a good employee. In addition, the employee and the manager know this, so it's likely the damage wouldn't have been done if only one person knew the password.
Nobody but that user must know the password. IT may have means to reset the password, and may be able to get into the computer after resetting the password, but they also must not know the current password and must not be able to change the password, cause damage from that user's account, and change the password back.
answered May 4 '16 at 7:45
gnasher729
71.8k31134226
add a comment |Â
up vote
0
down vote
Imagine some criminal damage is done, with incontrovertible evidence that it was done by someone having that person's username and password. Now you have a problem. There are two people, and you are quite sure that one is a criminal and one is quite innocent. Your company has a big problem. In Europe you have a huge problem because you know someone caused criminal damage and you can't fire them. In the USA, you still have a huge problem because there are two persons that you could fire, but one of them is totally innocent and you would lose what is likely a good employee. In addition, the employee and the manager know this, so it's likely the damage wouldn't have been done if only one person knew the password.
Nobody but that user must know the password. IT may have means to reset the password, and may be able to get into the computer after resetting the password, but they also must not know the current password and must not be able to change the password, cause damage from that user's account, and change the password back.
answered May 4 '16 at 7:45
gnasher729
71.8k31134226
add a comment |Â
up vote
0
down vote
up vote
0
down vote
Imagine some criminal damage is done, with incontrovertible evidence that it was done by someone having that person's username and password. Now you have a problem. There are two people, and you are quite sure that one is a criminal and one is quite innocent. Your company has a big problem. In Europe you have a huge problem because you know someone caused criminal damage and you can't fire them. In the USA, you still have a huge problem because there are two persons that you could fire, but one of them is totally innocent and you would lose what is likely a good employee. In addition, the employee and the manager know this, so it's likely the damage wouldn't have been done if only one person knew the password.
Nobody but that user must know the password. IT may have means to reset the password, and may be able to get into the computer after resetting the password, but they also must not know the current password and must not be able to change the password, cause damage from that user's account, and change the password back.
answered May 4 '16 at 7:45
gnasher729
71.8k31134226
Imagine some criminal damage is done, with incontrovertible evidence that it was done by someone having that person's username and password. Now you have a problem. There are two people, and you are quite sure that one is a criminal and one is quite innocent. Your company has a big problem. In Europe you have a huge problem because you know someone caused criminal damage and you can't fire them. In the USA, you still have a huge problem because there are two persons that you could fire, but one of them is totally innocent and you would lose what is likely a good employee. In addition, the employee and the manager know this, so it's likely the damage wouldn't have been done if only one person knew the password.
Nobody but that user must know the password. IT may have means to reset the password, and may be able to get into the computer after resetting the password, but they also must not know the current password and must not be able to change the password, cause damage from that user's account, and change the password back.
answered May 4 '16 at 7:45
gnasher729
71.8k31134226
answered May 4 '16 at 7:45
gnasher729
71.8k31134226
answered May 4 '16 at 7:45
gnasher729
71.8k31134226
answered May 4 '16 at 7:45
gnasher729
71.8k31134226
71.8k31134226
add a comment |Â
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fworkplace.stackexchange.com%2fquestions%2f2830%2fshould-the-manager-be-ccd-when-sending-username-and-password-to-employee%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
3
Where do you send this e-mail? That is, how does the user access their login credentials in the first place? (That said, I fully agree with @Oded's answer.)
– Michael Kjörling
Jul 27 '12 at 7:49
11
Hopefully A) this password is a random string and B) its only a one time use as sending any credentials in plaintext (let alone storing them) is both stupid and dangerous
– rickyduck
Jul 27 '12 at 9:00
If this is a new account, how are they going to log on to pick up the e-mail containing their password? In that situation, sending the initial password to the boss is usually the best option available.
– keshlam
May 4 '16 at 9:19
Why do you send them to the new user at all? How are they supposed to retrieve them? It would seem that sending the full credentials to the manager is the only way for the new account holder to receive them, correct?
– MrWonderful
Jun 8 '16 at 21:23
Inform the boss that a new account has been created but do not mail password. And by the way, the password you email MUST be a single use password...
– Caterpillaraoz
Sep 28 '17 at 12:20