Looking for suggestions on password management

[lcs01]

Hi, Experts,

I am going to design a web page for our clients. This page will requires clients to login first. However, I have not had a good plan to manage the passwords. When clients forget their password, we do not want to send a new password through email. What are the alternatives to send the passwords to clients?

Thank you for your advices.

 

[feherke]

Hi

What are the alternatives to send the passwords to clients?

I would say none. Although some people consider using password reminder phrase or secret question can be an alternative. Both the reminder phrase and the secret question are displayed on the web page after the user answered some other questions like his birthday set on the profile. In case of reminder phrase the user still has to guess the password himself. In case of secret question if the answer is correct the user is let to enter as normally or enter to a limited area where can only change his password.

I would prefer mailing a new random password.

Feherke.

http://rootshell.be/~feherke/

 

[ecobb]

Here's a discussion we had about this over at the ColdFusion forum. The first few posts may be too technical (specific code samples) and not really pertain to what you're asking, but after about the 3rd or 4th post it turns into a "best way to do this" discussion with problems/examples of different methods.

thread232-1257089

Maybe it will help to give you some ideas.


Hope This Helps!

ECAR
ECAR Technologies

http://www.ecartech.com

"My work is a game, a very serious game." - M.C. Escher

 

[lcs01]

To ECAR,

The link you gave me is very helpful.

Thank you very much.