#BREW PWGEN SOFTWARE#

Worse, that can take the password away and use it at a later time on an entirely different device. You log out of a site (manually or it logs you out after a period of inactivity) but don't properly lock your machine when walking away, or put your phone down unlocked, etc.: someone can now access that site as you even though you were logged out.

#BREW PWGEN SOFTWARE#

If the software is badly arranged enough that the admin knows the password instead of it being generated and sent to the target user without the admin being any the wiser, then it may be that the “force change on first login” option is missing too. The danger this poses can be reduced by forcing the user to choose a new password on first login, before any information is entered, but it still isn't good design to even need this mitigation. The main issue this behaviour-as-designed introduces is one new user being able to guess another new user's password. While still not good design it is at least mitigated somewhat in practise. > where the admin knowing their password is a requirementįor creating fresh accounts this is less of an issue than once the account has access to real data that has already been entered, so all the admin can get by knowing the password at this point is the information they already had to create the profile and account with. Unfortunately the people who have to use software are often not the people responsible choosing it! What way would someone want to use a web service where the admin knowing their password

Brew pwgen