Opinion about password fields....

Hello all,

I’m soliciting advice / tips here. I have a user registration form that will be completed by my client. He will register his customers in person so I grabbed the GeneratePassword function from WebLoginPE and made it a stand-alone snippet. The goal here is that as my client is registering his customers, he will have a random password created and added to the customers profile. They’ll get it in an email after successful registration. I want to hide the password and confirm password fields from the registration form. If I just apply a display:none you can see the values in the source.

Is this the only way to hide a field? Am I going to have this problem if I’m pre-populating these? The server is locked down and the page my client will use to register will be restricted to his access level. Is there even a problem here? I just feel weird having it in clear text even if it’s temporary. Thanks for any input.

I read this for WebLoginPE: http://modxcms.com/forums/index.php/topic,28622.msg239742.html#msg239742

For WebLogin I’m VERY satisfied with adding this code to websignup: http://modxcms.com/forums/index.php/topic,3050.0.html
even if "since sending the user an auto-generated password by email is inherently insecure"

Thanks for getting back to me so quickly. Ideally that’d be great to have it setup so that the customer can ’activate’ their account when they’re signed up. But I need to collect a lot of information right off the bat and this will be mobile. My client has a mobile service and they will be on location signing people up and they’ll need that account populated and active right away. The end customer will have the email waiting for them. I guess if there was a way to disable the account to web groups but be visible to managers?

What about adjusting the email so that the password isn’t sent. Instead they’re taken to a specific page to change the password by passing the hashed version through? So an email can read:

================
Bla bla bla

You must change your password before your account can be active. Click here to login and change your password.
===============

The click here can contain the MD5 string taking them to a page that will login them in and display only a change password form....hmmm. I figure that way the business manager can still access the profile from the web interface but the customer would not know what they’re password is and the only way they could access their account would be through the email sent? I think I got myself lost!

Ok,

So I have WebloginPE creating a password upon registration and emailing a message to the user that they need to login and change their password to activate their account. I’m stuck now on how to get that page working? I tried to hack my way through and piece together a login function but that’s not working too well. Can I just set my registration form up to verify? Still collecting all the info I need?

Edit: I think I’m trying to make this more confusing than need be. All I’m trying to do is capture a bunch of profile information and then for an activation(verify) through the customers email. However all the info is still captured at the initial registration.....