Phone number as employee password is a security risk

[chsasank]

Phone number is being used as password for employee by default when created. This is a clear security risk because email + number is a very common knowledge. We should consider sending randomly generated password via email and asking it to be reset on first login. Happy to contribute this feature if guided.

[chsasank]

We just need a random text generator here:

horilla/employee/models.py

Line 491 in 5e24821

password = self.phone

following by email sender

[horilla-opensource]

Hi @chsasank,

Thank you for your valuable feedback regarding the use of phone numbers as initial passwords for employees. We understand your concern about the potential security risks associated with this approach.

This mechanism was designed for ease during the initial setup, where admins create user accounts and share credentials with employees. Since not all users have email configured in the backend system, sending randomly generated passwords via email isn't always feasible. This approach aimed to reduce the workload for admins by avoiding the need to manually copy and share each password.

That said, we completely acknowledge the security risks involved. Based on your suggestion and our review, we will be removing this mechanism in the next version of Horilla. Instead:

• Password reset links will be pre-generated for all new accounts.
• Admins can easily share these links with employees, allowing them to set secure passwords on their own.

We appreciate the time and effort you’ve dedicated to testing Horilla and sharing your thoughts. Your input helps us continually improve and refine the system.

Thank you once again!

Best regards,
Team Horilla

[chsasank]

Hey! I'm happy to make this pull request if you guys are open.

[chsasank]

You can use django sesame to accomplish this: https://github.com/aaugustin/django-sesame

[horilla-opensource]

Hey! I'm happy to make this pull request if you guys are open.

Hi @chsasank ,

Please feel free to do so. We are open to all kinds of contributions to the codebase.

Thanks for suggestions and support to the system.

With Regards,
Team Horilla

[TalibY22]

was thinking what if they implemented a force reset when the employee log in the first time?

[chsasank]

Still a security risk. Because employees might not login immediately the first time and malicious actor could imitate on their behalf.