#773 Change password on 1st login

[geckonapper]

One way it was suggested to do that is have expiring passwords, and then set a password to expire immediately.

[Greg Roach]

Logged In: YES
user_id=1466942
Originator: NO

Why would we want to do this?

The usual reasons for making people change their password on first login is when the system administrator has chosen the password or when the password has been sent to the user through unencrypted email. Neither apply with PGV.

It would just annoy people and offer no real security benefit.

[geckonapper]

Logged In: YES
user_id=1447441
Originator: YES

Here's why:

I create an account for johndoe1 with the password "yankees". I give him his credentials and by having him change pw on 1st logon, I figure I'm making it easier on him. Most people nowadays are having to remember several username/passwords and this lets him choose something that he is comfortable with and easy to remember.

Perhaps there should be a checkbox "User must change pw on 1st login". I vote for a checked default.