Tell me more ×
The Workplace Stack Exchange is a question and answer site for members of the workforce navigating the professional setting. It's 100% free, no registration required.
up vote 13 down vote favorite

I often create logins for new employees and then send them an email with their login credentials. While doing so I also CC their manager to let him know his user has been setup.
Is this the right thing to do? Should the manager be CC'd when sending a username and password to the user?

In this case, the employes are part of an operation team who basically process paperwork and things in the database. They do not do anything confidential as such, but of course are responsible for what they do.

share|improve this question
Where do you send this e-mail? That is, how does the user access their login credentials in the first place? (That said, I fully agree with @Oded's answer.) – Michael Kjörling Jul 27 '12 at 7:49
1  
Hopefully A) this password is a random string and B) its only a one time use as sending any credentials in plaintext (let alone storing them) is both stupid and dangerous – rickyduck Jul 27 '12 at 9:00

8 Answers

up vote 48 down vote accepted

You should inform the manager that the credentials were created.

You should not send said credentials to the manager - in particular, if you have an audit trail that involves users, how can you be certain that when such a user is flagged by the system it is indeed the user and not their manager?

The whole point of login credentials is to ensure a logged in user is who they say they are (authentication), in order to give them access to whatever they need (authorization) and in some cases to allow for an audit trail.

Giving their credentials to someone else completely subverts this.

share|improve this answer
1  
I guess I was doing it wrong. – enthusiast Jul 26 '12 at 19:51
2  
Well, that's only a real problem if the credentials are permanent; after all, the admin ('you') know them too! If the credentials require a change on first login, this is less of a problem. – Clockwork-Muse Jul 26 '12 at 21:45
4  
At our workplace, not even the IT know the passwords. Every new user is prompted at login to change their password after given a default one. Then every 90 days, we get asked to change it again. If we forget our password, we ask IT and they assign a generic password where we are again asked to change it when we log in. We use Windows. – SaultDon Jul 26 '12 at 22:50
1  
Another point to make is that if those credentials are provided by the user and you forward them to the manager, how do you know you're not inadvertently sending the user's banking password to the manager as well! – jmort253♦ Jul 26 '12 at 23:09
6  
@Thecrocodilehunter - No time like now to change these traditions... As others have commented, in many environments, an initial password is setup which the system requires the user to change as soon as they log-in the first time. There is no password recovery service either - if the user forgot their new password, the admin will set a new one with the same condition - it needs to be changed as soon as the user logs in. This keeps the password secure with the user. The status quo you have is not a good one, change it for a better system. – Oded♦ Jul 27 '12 at 13:11
show 2 more comments
up vote 10 down vote

Sure, go ahead - as long as the user is required to change the password upon first login. They are, right? I mean, the goal here is to get the employee their credentials, and prove you've done so / get them to someone with a vested interest in assisting that new employee, while maintaining security.

This way you get all that, plus the user has to change their password "on first login" or whatever it's called now, so nothing is compromised.

I've seen systems that handle password changes this way too - forget your password, they email a new (temporary) one to your direct manager.

share|improve this answer
up vote 10 down vote

You can send two emails for this. This is what is followed in our company and the managers never have a problem with it.

To: Employee

Cc: Manager1, Manager2

Dear Employee,

You have been registered in the system. Your username is firstname.lastname.

To adhere to the company's security policies, the password will be sent in the next e-mail marked only to you.

Regards, IT Team

To: Employee

Dear Employee,

The password to the username firstname.lastname is mynewpassword. We request you to change it immediately.

Regards, IT Team

share|improve this answer
2  
It would seem that including the username and password in the second email negates the point of sending username and password separately! – Jeromy French Jan 11 at 19:58
@JeromyFrench: How so? The point is that the second e-mail is sent only to the employee, not to the manager(s). (Sending plain-text passwords by e-mail is another issue, which is discussed by the other answers.) – Keith Thompson Jan 12 at 1:39
Jeromy is right. Seding both the username and the password in the second email means a) anyone intercepting that email can login to the account b) the first email is pointless. The second email should read "the password of your recently created account is 'mynewpassword'" – DJClayworth Jan 14 at 14:56
How is the employee going to receive the password if he can not log in to the system to get his email? – Chad Jan 14 at 15:00
up vote 7 down vote

While it's appropriate to send a password via email, that password must be temporary; upon first login, the system must force a password change. Most enterprise-grade products support this option.

The problem is that credentials should not be stored anywhere in the open -- email least of all, since that's the first place attackers will look. Sending the password in a separate email doesn't really help, since a hacker who gets into your email will be able to see both messages, so you're no safer that way. Also, you may be required by a manager or anyone else for that matter to copy them on emails like this, significantly increasing your attack surface and the likelihood of an attacker getting the password.

The best solution is to simply force the user to change his password. Do not request that that the user change his password, since he never will. There are thousands of accounts out there with the password 12345 which was assigned as a temporary password and which the user was requested to change... and which he never did change.

share|improve this answer
up vote 4 down vote

If you're asking this, then you're in IT. ask your boss what company policy is. That's the safest path. Otherwise, I'd be inclined to say no, do not give managers the credentials.

However, ALWAYS let the manager know that a logon has been created for their underling. If they then request the credentials, ask them to submit that via your boss, so that it goes through proper channels.

share|improve this answer
3  
If they're requesting the credentials, something is majorly wrong. – jmort253♦ Jul 26 '12 at 23:10
@jmort253 not neccessarily. generally, it's not good. but in some cases it's fine. case-by-case basis. after all, if the employee is sick, and was supposed to give a presentation, the boss might request access to employee's machine to pull up relavent files in order to give presentation themself – acolyte Jul 27 '12 at 5:07
2  
Then that's a risk that should be factored in. Bob shouldn't be the only person to have access to the files. The manager should be able to use his/her own login to access the system. As Oded says, the whole point of authentication is to verify that the person accessing a resource is who he/she says he is. For instance, that's why Google Docs has a sharing feature, so I don't have to give you access to all my stuff. In this case, the something that's majorly wrong is the lack of planning on the part of the employee, manager, and IT department. – jmort253♦ Jul 27 '12 at 7:24
up vote 3 down vote

NO! it is not - this is security and sysadmin 101.

Also you do not ever send the user name and password in the clear, in the same document. Best practice is to create a temp password and communicate this to the employee via some other method and have the user change the password on login.

share|improve this answer
up vote 1 down vote

If you are located near the new employees you can have them pickup a hard copy of the login information. You will just need to let the manager know that it is ready.

If there is a great distance between you and the employees, you will have to email the manger the credentials. This is to let them give the credentials to the new employee.

I worked for a place that tried to tell you to pickup the passwords by leaving a voice mail. They also sent you an email to tell you your voice mail was now enabled. Needless to say that method didn't work very well for new employees.

I also sent credentials to a manger once because the employee wouldn't try to login. They told their manager they never got them. After 4 or 5 cycles of creating a new temporary password and sending it out, they miraculously arrived after I also sent them to the manager.

share|improve this answer
up vote 0 down vote

A solution I've used, but didn't see suggested: Send the new user an email letting them know their account has been set up. If cc'ing their manager seems appropriate or necessary, then do so. However, you send them your telephone number and have them call (or visit) you to get their credentials. Or, you might send them their login id in this email; however, do not send the password via email.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.