Re: Passwords in emails

I can't specify a written standard - but that email will reside in multiple email servers, pass thru servers you have no control over, plus the user's pc for a long time, even if email deleted.
I would not do it. If doing a pwd that is set to *expired so they have to change it, cannot use same pwd over again (read that in PCI compliance stuff).
I have seen people use a sentence to describe what an expired password is set to - like :

Last letter of your 1st name plus
last 4 digits of your social sec# plus
your birth month (2 digits) plus
the digits 577 (this is random#)

I would then keep a list of records sent, and if not signed on within 24 hours, disable the account. Not sure this is any standard, but have seen in several places.

Jim Franz

----- Original Message ----- From: "Burns, Bryan" <Bryan_Burns@xxxxxxxxxxxx>
To: <MIDRANGE-L@xxxxxxxxxxxx>
Sent: Wednesday, October 08, 2008 10:08 AM
Subject: Passwords in emails

What kind of risk do we take if I email an iSeries password to a remote user using my Microsoft Outlook client? Is this forbidden by any standards being that it's clear text?

Bryan Burns
iSeries Specialist
ECHO, Incorporated
Lake Zurich, Illinois

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.