Re: Passwords in emails

["Jim Franz" <franz400@xxxxxxxxxxxx>]

I can't specify a written standard - but that email will reside in multiple 
email servers, pass thru servers you have no control over, plus the user's 
pc for a long time, even if email deleted.
I would not do it. If doing a pwd that is set to *expired so they have to 
change it, cannot use same pwd over again (read that in PCI compliance 
stuff).
I have seen people use a sentence to describe what an expired password is 
set to - like :

Last letter of your 1st name plus
last 4 digits of your social sec# plus
your birth month (2 digits) plus
the digits 577            (this is random#)

I would then keep a list of records sent, and if not signed on within 24 
hours, disable the account. Not sure this is any standard, but have seen in 
several places.

Jim Franz

----- Original Message ----- 
From: "Burns, Bryan" <Bryan_Burns@xxxxxxxxxxxx>
To: <MIDRANGE-L@xxxxxxxxxxxx>
Sent: Wednesday, October 08, 2008 10:08 AM
Subject: Passwords in emails


> What kind of risk do we take if I email an iSeries password to a remote 
> user using my Microsoft Outlook client?  Is this forbidden by any 
> standards being that it's clear text?
>
> Bryan Burns
> iSeries Specialist
> ECHO, Incorporated
> Lake Zurich,  Illinois
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.