1

When a new user registers for a new account, WordPress sends an email with the login information as usual. The password is auto-generated and stored securely in the WP database and the registration is handled by MemberMouse. MemberMouse defers all user authentication to WP's built in system so they don't do any of the generation themselves.

What I'd like to do is route this new user to a Thank You page that displays some information like instructions on what to do next and will also display the username and generated password on this HTTPS page that allows them to more easily login since emails often end up in the spam folder.

Is there an easy way to do this?

Improve this question

1 Answer 1

Reset to default
2

No as it will be insecure to do it. Being able to display the password to the user means that you store it as a plain text somewhere which is a big no no.

Emails ending in spam should not be relevant here as you should not send passwords in email.

(sure you can hack something to make what you want but the system is not built to support such a thing)

Improve this answer
7
  • What if the hashed password is sent from the database to the client and decrypted only on the client instead of server-side? Assuming the site is HTTPS, couldn't you pass an encrypted version of the password to local storage or something similar and then it's decrypted once the page renders?
    – micah
    Commented Dec 16, 2015 at 3:57
  • hashes are used for password storage because they cannot be decrypted. hashing is a one way thing, not symmetrical at all.
    – Mark Kaplun
    Commented Dec 16, 2015 at 4:00
  • My mistake, my terminology is wrong. But does is the concept I talked about still sound like a possible way of doing this securely?
    – micah
    Commented Dec 16, 2015 at 4:03
  • If you meant string the password encrypted in addition to the hash then the decryption code is still part of your site which means that the end result is the same as storing it in plain text and everyone with access to the code and DB can find the password.
    – Mark Kaplun
    Commented Dec 16, 2015 at 4:03
  • There's no way to decrypt the password client-side only after it's in local storage?
    – micah
    Commented Dec 16, 2015 at 4:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.