Documentation[edit]

This is the text shown in the body of the e-mail sent when a user creates an account for another user e.g. through Wikipedia:Request an account. The subject line for the e-mail is at MediaWiki:Createaccount-title.

Parameters: $1 - IP address of the person who creates the account (i.e. the one who fills in the form, not the one who receives the password); $2 - Username of the new account; $3 - Password of the new account; $4 - URL of the Main Page in the form http://en.wikipedia.org/w/index.php

Discussion[edit]

Consider allowing user name and password in separate emails.[edit]

Some corporate policies forbid the current implementation. SChalice 21:49, 5 March 2012 (UTC)[reply]

I'm not sure what the benefits of this would be. The automatically-generated password (I think) is forced to be changed at first login, so if someone does try to illegally access someone else's account using the details in the email, they would only get access to an unused account (so they may as well just create one for themself). Of course they could take the username and send it a password reset to gain access that way but your suggestion wouldn't stop that.

In any case, people are expected to keep their email accounts secure so none of this should really happen. There's also a big difference between Wikipedia accounts and corporate accounts - Wikipedia allows anyone to sign up so there's not a lot of value (unless there's a nice username) in taking a brand-new account. Tra (Talk) 22:23, 5 March 2012 (UTC)[reply]

they would only get access to an unused account That unused account is in someone elses name. They have now hijacked a corporate identity.

I am not saying that I agree with the policies. I am not saying that the policies make sense. I am telling you that this implementation is disallowed by many billion dollar companies. I am guessing the issue is that when someone has a cublicle, anyone can look over the users shoulder and see an email with both a user name and password on it. Putting it onto two emails prevents the casual walker-byer from viewing both password and username. - SChalice 19:15, 1 April 2012 (UTC)[reply]

A seemingly stupid thought is to have the password separated from the username by a enough lines of text to force a page scroll. I have seen this on some old websites. - SChalice 19:28, 1 April 2012 (UTC)[reply]