But why can't I send people their passwords?
>7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would you really like someone to gain credentials to your product when this happens?This is one I always struggled to understand. If email is compromised, the attacker can request and immediately intercept a password reset anyway.[edit: Many excellent points below. I think some of these should be in the FAQ.