CMS Made Simple Forums
https://forum.cmsmadesimple.org/

Installation Assistant sends cleartext password by mail
https://forum.cmsmadesimple.org/viewtopic.php?f=89&t=76510
Page 1 of 1

Author:  tristan [ Wed Apr 26, 2017 9:16 pm ]
Post subject:  Installation Assistant sends cleartext password by mail

IMHO it would be better to not include the admin password in the mail thats sent after a successful installation. Since email is inherently insecure and know the password is saved in at least one location (mailbox) in cleartext.

Maybe we could skip the "Your installation of CMS Made Simple is complete." email altogether since we already know we installed the CMS successfully because the Installation Assistant told us and we're going to set the Mail Settings properly after we login the first time anyway.

Author:  calguy1000 [ Wed Apr 26, 2017 9:40 pm ]
Post subject:  Re: Installation Assistant sends cleartext password by mail

You can choose not to receive the email by turning on the advanced mode.

But... people have requested that we NOT drop the email.

Author:  tristan [ Wed Apr 26, 2017 9:58 pm ]
Post subject:  Re: Installation Assistant sends cleartext password by mail

Shouldn't it be an option to send the email in advanced mode and make it default not to send out an email to make new installs a little more secure?

Page 1 of 1 All times are UTC
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/