97%+ of people don't care about passwords being sent in plain text over email for non-banking sites. Or for accounts that have no info until you populate them.
The other 3% can just log in and CHANGE the password after-the-fact.
I'd rather not inconvenience the majority of my signups, nor force my ideas on how things should work on them.
And what percentage would – like me – delete their account as soon as you send them a plaintext temp password?
You're living in the past if you think this is an acceptable practice. I don't care how trivial your web service is, if you're throwing my password around willy-nilly, I don't want you.
But usually, those links expire, or are only able to be used once. So the password the user creates is secure, and the period the attacker can use the captured link is only from the time the user requests the password reset until the time the user tries to use the reset, it doesn't work, and the user requests another reset.
When a user is sent a password via email, unless that user is required to change eir password upon entering it, it is inherently less secure than sending a link.
This isn't an attack for the downvote. But if you're the type of customer that flips out over getting your temp password in the mail to a blank account, I don't want you. As the troubles are only starting...
97%+ of people don't care about passwords being sent in plain text over email for non-banking sites. Or for accounts that have no info until you populate them.
The other 3% can just log in and CHANGE the password after-the-fact.
I'd rather not inconvenience the majority of my signups, nor force my ideas on how things should work on them.