Password is sent in clear on initial registration email to new customer.

[JRR]

A customer asked me why the system sends the password in clear on his registration email. And while I don't think it is too much of a security issue (we don't collect or store credit card info) his point was he felt that passwords should never be sent in clear in an email.

So, should I turn it off (how?) or do most not consider it an issue?

I'm inclined to turn it off once I figure out how, as I think his point is reasonable, but no one else has said anything on this matter before. He is probably in IT...

Thanks,

John :-#)#

[ridexbuilder]

I've had this valid point mentioned on a couple of occasions over the course of a decade.
The simplest method I found, is to modify the email template for successful registration - I'll try to find it again, to provide an example.
EJ

[ridexbuilder]

File: public_html/catalog/create_account.php, line 382 onwards..

      // BOF PHONE ORDER
      // $email_text .= EMAIL_ACCOUNT_DETAILS . "\n" . EMAIL_ACCOUNT_USERNAME . $email_address . "\n" . EMAIL_ACCOUNT_PASSWORD  . $password . "\n\n";
      $email_text .= EMAIL_ACCOUNT_DETAILS . "\n" . EMAIL_ACCOUNT_USERNAME . $email_address . "\n" . EMAIL_ACCOUNT_PASSWORD  . EMAIL_ACCOUNT_PASSWORD_REPLACEMENT . "\n\n";
      // EOF PHONE ORDER 

File: public_html/catalog/includes/languages/english/create_account.php, line 25 onwards..

define('EMAIL_ACCOUNT_PASSWORD', 'Password: ');
define('EMAIL_ACCOUNT_PASSWORD_REPLACEMENT', '******* (masked). If necessary use Password Forgotten feature');

Also make a similar change to any other language files that are used.

IMHO, it would be better if this was used by default.

[JRR]

Thanks, implemented now! Clean forgot to do it as we were moving our shop after being in the same location for 35 years...