Password reset sent to emails without PGP - Bad practise

prass7

As a security company, I cannot believe that the forum password is sent to unencrypted emails. You should set an example of privacy.

Either you should have a PGP or GNU Open PGP option to collect the user's public key or the end users should pick the password directly from your server with a captcha.

Thanks

torstenk

It seems that you are a PGP paranoid. It is a nice idea, but it does not make sense.
The first step would be to enable SSL for this forum. Up to now there is only a self-signed certificate. And this does not work.

But, to be honest. This is a forum and it does not require so much security. In addition, it does not make sense as long as there is no identification check during the registration.