# Good idea to send encrypted password with activation link

**URL:** <https://www.ruby-forum.com/t/good-idea-to-send-encrypted-password-with-activation-link/196070>\
**Category:** Rails\
**Created:** [October 6, 2010, 10:09am UTC](https://www.ruby-forum.com/t/good-idea-to-send-encrypted-password-with-activation-link/196070 "2010-10-06T10:09:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![slay\_mithos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/df705f/32.png) [@slay\_mithos](https://www.ruby-forum.com/u/slay_mithos)\
**Post date:** [October 6, 2010, 10:09am UTC](https://www.ruby-forum.com/t/good-idea-to-send-encrypted-password-with-activation-link/196070/1 "2010-10-06T10:09:19Z")

</div>

Is this good idea to send activation link with encrypted password

---

<div class="post-metadata">

**Author:** ![slay\_mithos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/df705f/32.png) [@slay\_mithos](https://www.ruby-forum.com/u/slay_mithos)\
**Post date:** [October 6, 2010, 2:41pm UTC](https://www.ruby-forum.com/t/good-idea-to-send-encrypted-password-with-activation-link/196070/2 "2010-10-06T14:41:07Z")

</div>

Felix Samy wrote:

> Is this good idea to send activation link with encrypted password

Why would you want to send the encrypted password anywhere?

---

<div class="post-metadata">

**Author:** ![slay\_mithos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/df705f/32.png) [@slay\_mithos](https://www.ruby-forum.com/u/slay_mithos)\
**Post date:** [October 6, 2010, 2:51pm UTC](https://www.ruby-forum.com/t/good-idea-to-send-encrypted-password-with-activation-link/196070/3 "2010-10-06T14:51:35Z")

</div>

On Wed, Oct 6, 2010 at 8:41 AM, Ar Chron [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Felix Samy wrote:
> 
> > Is this good idea to send activation link with encrypted password

then encrypted password?  
For what??

---

<div class="post-metadata">

**Author:** ![slay\_mithos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/df705f/32.png) [@slay\_mithos](https://www.ruby-forum.com/u/slay_mithos)\
**Post date:** [October 6, 2010, 4:33pm UTC](https://www.ruby-forum.com/t/good-idea-to-send-encrypted-password-with-activation-link/196070/4 "2010-10-06T16:33:27Z")

</div>

I recently started with Authlogic and it specifically uses a  
specifically  
generated temporary token for such so that it is not necessary to send  
an  
encrypted password or anything else. I think in general security wise if  
you  
are using encryption that you dont want a lot of your encrypted data  
floating around as given a large enough sample available publicaly  
theoretically it could be possible to determine your encryption keys.

David

---

<div class="post-metadata">

**Author:** ![slay\_mithos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/df705f/32.png) [@slay\_mithos](https://www.ruby-forum.com/u/slay_mithos)\
**Post date:** [October 6, 2010, 4:38pm UTC](https://www.ruby-forum.com/t/good-idea-to-send-encrypted-password-with-activation-link/196070/5 "2010-10-06T16:38:08Z")

</div>

PS, this is the authlogic explanation. Their point is that the token  
expires, as unless you put in other safeguards if the encrypted password  
might be able to be used again, for security purposes it really should  
be  
reset. I think my prev explanation is probably highly unlikely.

[http://rdoc.info/github/binarylogic/authlogic/master/Authlogic/ActsAsAuthentic/PerishableToken](http://rdoc.info/github/binarylogic/authlogic/master/Authlogic/ActsAsAuthentic/PerishableToken)