Welcome email is a significant security issue

[boomschtick]

Inspired by this thread in the Ideas forum: https://www.3cx.com/community/threads/security-risk.45381/

This feels like a very big deal to me and I think deserves more attention. Quoting my last post in that thread:

So, does 3cx not consider sending out <AuthPass></AuthPass> and <TunnelPass></TunnelPass> in plain text not a serious security concern?

The fact that we have not received any input from 3cx support makes it seem that way.

If any of those config files lands in the wrong hands, it could be very bad indeed.

 

[boomschtick]

:bump:

 

[llebihan]

I agree

 

[daneke]

Then don't send one. Give new users a sticky

 

[boomschtick]

Then don't send one. Give new users a sticky

Seriously? That's hardly a solution. 3cx is a global solution and this needs a global fix. I have users in Europe, Australia and all over the US. I love the convenience of the welcome email, but it has WAY too much information in it from a security standpoint.

 

[N_G]

SP 2 will have provisioning via QR code and then there is no need to send the provisioning file for the smartphones....

 

[boomschtick]

SP 2 will have provisioning via QR code and then there is no need to send the provisioning file for the smartphones....

Great news. What's going on for the desktop clients?

 

[Zephnath]

Then don't send one. Give new users a sticky

Users also have the ability to request the welcome email via the web client. (Profile > Resend Credentials) @Boomshtick is correct, not sending one is not the solution.

I'd personally like to see a whitelisting/blacklisting feature that allows admins to either approve or deny clients before they are allowed to authenticate. Also having the client prompt for authentication credentials would be a better than an unencrypted email with plain text username and password within the xml.