Hacker News new | ask | show | jobs
by TrianguloY 1274 days ago
As the comment suggests: you are an admin and you need to create a few new accounts. If you do need to create hundreds you will probably use a batch script or something, but for just a couple using a web ui seems more convenient, and using an autogenerated password helps you.

In that case, if you are not paying attention all the new accounts will have the same password, which is a privacy issue.
2 comments
dncornholio 1274 days ago
Smart! But such an edge-case, I don't find this bug as ridiculous..

On another note, admin shouldn't be sending entering other peoples passwords anymore, they should be sending invites links that let's the user insert their own.

link
hackmiester 1274 days ago
That is a narrow view of all the different ways people might use a Web service.
link
Xelynega 1274 days ago
"The admin never knows the user's password" is a pretty simple security step for any setup. What way would someone want to use a web service where the admin knowing their password is a requirement?
link
dspillett 1273 days ago
> What way would someone want to use a web service where the admin knowing their password

Unfortunately the people who have to use software are often not the people responsible choosing it!

> where the admin knowing their password is a requirement

For creating fresh accounts this is less of an issue than once the account has access to real data that has already been entered, so all the admin can get by knowing the password at this point is the information they already had to create the profile and account with. While still not good design it is at least mitigated somewhat in practise. The main issue this behaviour-as-designed introduces is one new user being able to guess another new user's password. The danger this poses can be reduced by forcing the user to choose a new password on first login, before any information is entered, but it still isn't good design to even need this mitigation. If the software is badly arranged enough that the admin knows the password instead of it being generated and sent to the target user without the admin being any the wiser, then it may be that the “force change on first login” option is missing too.

link
ekianjo 1274 days ago
not so much a privacy issue than a security one
link
TrianguloY 1274 days ago
oops, you are right. Can't edit now :(
link