Take the 2-minute tour ×
The Workplace Stack Exchange is a question and answer site for members of the workforce navigating the professional setting. It's 100% free, no registration required.

I often create logins for new employees and then send them an email with their login credentials. While doing so I also CC their manager to let him know his user has been setup.
Is this the right thing to do? Should the manager be CC'd when sending a username and password to the user?

In this case, the employes are part of an operation team who basically process paperwork and things in the database. They do not do anything confidential as such, but of course are responsible for what they do.

share|improve this question
1  
Where do you send this e-mail? That is, how does the user access their login credentials in the first place? (That said, I fully agree with @Oded's answer.) –  Michael Kjörling Jul 27 '12 at 7:49
2  
Hopefully A) this password is a random string and B) its only a one time use as sending any credentials in plaintext (let alone storing them) is both stupid and dangerous –  rickyduck Jul 27 '12 at 9:00

8 Answers 8

up vote 51 down vote accepted

You should inform the manager that the credentials were created.

You should not send said credentials to the manager - in particular, if you have an audit trail that involves users, how can you be certain that when such a user is flagged by the system it is indeed the user and not their manager?

The whole point of login credentials is to ensure a logged in user is who they say they are (authentication), in order to give them access to whatever they need (authorization) and in some cases to allow for an audit trail.

Giving their credentials to someone else completely subverts this.

share|improve this answer
1  
I guess I was doing it wrong. –  enthusiast Jul 26 '12 at 19:51
2  
Well, that's only a real problem if the credentials are permanent; after all, the admin ('you') know them too! If the credentials require a change on first login, this is less of a problem. –  Clockwork-Muse Jul 26 '12 at 21:45
4  
At our workplace, not even the IT know the passwords. Every new user is prompted at login to change their password after given a default one. Then every 90 days, we get asked to change it again. If we forget our password, we ask IT and they assign a generic password where we are again asked to change it when we log in. We use Windows. –  user2059 Jul 26 '12 at 22:50
1  
Another point to make is that if those credentials are provided by the user and you forward them to the manager, how do you know you're not inadvertently sending the user's banking password to the manager as well! –  jmort253 Jul 26 '12 at 23:09
7  
@Thecrocodilehunter - No time like now to change these traditions... As others have commented, in many environments, an initial password is setup which the system requires the user to change as soon as they log-in the first time. There is no password recovery service either - if the user forgot their new password, the admin will set a new one with the same condition - it needs to be changed as soon as the user logs in. This keeps the password secure with the user. The status quo you have is not a good one, change it for a better system. –  Oded Jul 27 '12 at 13:11

Sure, go ahead - as long as the user is required to change the password upon first login. They are, right? I mean, the goal here is to get the employee their credentials, and prove you've done so / get them to someone with a vested interest in assisting that new employee, while maintaining security.

This way you get all that, plus the user has to change their password "on first login" or whatever it's called now, so nothing is compromised.

I've seen systems that handle password changes this way too - forget your password, they email a new (temporary) one to your direct manager.

share|improve this answer

You can send two emails for this. This is what is followed in our company and the managers never have a problem with it.


To: Employee

Cc: Manager1, Manager2

Dear Employee,

You have been registered in the system. Your username is firstname.lastname.

To adhere to the company's security policies, the password will be sent in the next e-mail marked only to you.

Regards, IT Team


To: Employee

Dear Employee,

The password to the username firstname.lastname is mynewpassword. We request you to change it immediately.

Regards, IT Team

share|improve this answer
3  
It would seem that including the username and password in the second email negates the point of sending username and password separately! –  Jeromy French Jan 11 '13 at 19:58
1  
Jeromy is right. Seding both the username and the password in the second email means a) anyone intercepting that email can login to the account b) the first email is pointless. The second email should read "the password of your recently created account is 'mynewpassword'" –  DJClayworth Jan 14 '13 at 14:56
1  
How is the employee going to receive the password if he can not log in to the system to get his email? –  ReallyTiredOfThisGame Jan 14 '13 at 15:00

While it's appropriate to send a password via email, that password must be temporary; upon first login, the system must force a password change. Most enterprise-grade products support this option.

The problem is that credentials should not be stored anywhere in the open -- email least of all, since that's the first place attackers will look. Sending the password in a separate email doesn't really help, since a hacker who gets into your email will be able to see both messages, so you're no safer that way. Also, you may be required by a manager or anyone else for that matter to copy them on emails like this, significantly increasing your attack surface and the likelihood of an attacker getting the password.

The best solution is to simply force the user to change his password. Do not request that that the user change his password, since he never will. There are thousands of accounts out there with the password 12345 which was assigned as a temporary password and which the user was requested to change... and which he never did change.

share|improve this answer

If you're asking this, then you're in IT. ask your boss what company policy is. That's the safest path. Otherwise, I'd be inclined to say no, do not give managers the credentials.

However, ALWAYS let the manager know that a logon has been created for their underling. If they then request the credentials, ask them to submit that via your boss, so that it goes through proper channels.

share|improve this answer
3  
If they're requesting the credentials, something is majorly wrong. –  jmort253 Jul 26 '12 at 23:10
2  
Then that's a risk that should be factored in. Bob shouldn't be the only person to have access to the files. The manager should be able to use his/her own login to access the system. As Oded says, the whole point of authentication is to verify that the person accessing a resource is who he/she says he is. For instance, that's why Google Docs has a sharing feature, so I don't have to give you access to all my stuff. In this case, the something that's majorly wrong is the lack of planning on the part of the employee, manager, and IT department. –  jmort253 Jul 27 '12 at 7:24

NO! it is not - this is security and sysadmin 101.

Also you do not ever send the user name and password in the clear, in the same document. Best practice is to create a temp password and communicate this to the employee via some other method and have the user change the password on login.

share|improve this answer

If you are located near the new employees you can have them pickup a hard copy of the login information. You will just need to let the manager know that it is ready.

If there is a great distance between you and the employees, you will have to email the manger the credentials. This is to let them give the credentials to the new employee.

I worked for a place that tried to tell you to pickup the passwords by leaving a voice mail. They also sent you an email to tell you your voice mail was now enabled. Needless to say that method didn't work very well for new employees.

I also sent credentials to a manger once because the employee wouldn't try to login. They told their manager they never got them. After 4 or 5 cycles of creating a new temporary password and sending it out, they miraculously arrived after I also sent them to the manager.

share|improve this answer

A solution I've used, but didn't see suggested: Send the new user an email letting them know their account has been set up. If cc'ing their manager seems appropriate or necessary, then do so. However, you send them your telephone number and have them call (or visit) you to get their credentials. Or, you might send them their login id in this email; however, do not send the password via email.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.