Onboarding 1200 New Users - how to communicate passwords?

When you use a password manager, your passwords are exposed in memory as cleartext for at least the split second you're using them to fill a field. This is not just a technicality, there are tools that exist to exploit this, this is why you need to think about the security of your password manager.

If passwords in cleartext are an unacceptable security risk, you simply can't use them at all. Sending an email exposes passwords in cleartext, submitting a token to get a password reset still means the password is in cleartext as its being entered, using a password manager does not avoid passwords being in cleartext! turns out passwords are just kinda shitty.

/r/sysadmin Thread Parent