Issuing Web Site User Names Safely
I am often asked how to select and then send out web site login user names. If you have a relatively small number of users and they don't change often, don't get complicated - just send them in the post.
User names identify an individual during authentication processes like logging on. Self-registration systems can often be used to help guess current ones.
But if you have a known set of users such as customers, members or clients, select the user names yourself, don't use the internet (such as email) to communicate these to the users. Transfer them some other way ("out-of-band" is security jargon), perhaps using conventional post, signed for on receipt, to an address you already have on record, by hand (perhaps at an event or conference) or possibly by telephone or fax.
It's also better to disable user accounts which are not used within a reasonable period of the communication being sent as this may indicate the address was incorrect.
Posted on: 26 August 2008 at 09:49 hrs
Comments are filtered automatically and should appear shortly after they been checked.