[Mailman-Users] Passwords

[Nigel Metheringham]

On Wed, 2003-06-04 at 23:18, Derek Simkowiak wrote:
> 	Replace the "password reminder" email with a simple "confirmation" 
> email.  If you want to keep user options hidden then replace the 
> "Password Reminder" button with a "Email me my options page URL" button, 
> which emails the user a URL with an embedded cookie.

Its a password!
OK, it can be made time limited (how long though) and stuff like that,
but its still really a password :-)

I like the idea, except it needs to be expanded so that web access is
not required - you should be able to do this all by email too.

Maybe - if the installation handles VERP-like addressing - the cookie
can be made part of the sender address so a reply (from a sane MUA - we
aren't going to bend over backwards for the criminally insane here)
would be pre-authenticated - again with time limits and stuff (a day or
so is OK, a month isn't).   However if we do this sort of magic then we
need to handle the worst that stupid MTAs come up with for bounces.

	Nigel.
-- 
[ Nigel Metheringham           Nigel.Metheringham at InTechnology.co.uk ]
[ - Comments in this message are my own and not ITO opinion/policy - ]