Lost password email should not have real password in email

[jrp2]

Overall I am super-pleased with Kayako, but this policy of sending the actual password in the lost password email is generally considered bad form. Many people use the same password for many applications, and this ends up sending that password in a clear text email.

Most "lost password" schemes involve setting a randomly generated password and mailing that to the customer. They can then log back in and change their password to whatever they want. Some go further by sending a one-time token. That is probably best, but perhaps overkill.

It would seem relatively trivial to do. The code to set random passwords already exists. It would just involve invoking that code before sending the lost password email.

Just my thoughts. Keep up the good work, Kayako is a really nice application!

JP

PS. Yes, of course I have disabled sending the password in ticket emails! I am glad that was configurable!