In Settings/Password email there is a checkbox to send passwords to new contacts.
By default it is checked..
Edit that email and uncheck.

WA team - the default for that should be OFF so that if the admin really wants to send clear passwords (not very smart), the admin has to consciously decide to do that

Credit card information is not the only sensitive information stored on the site. Please improve the security of the password process

I agree that sending passwords plain texts is not secure. We plan to address this. However, all credit card information is processed with extra care, in full compliance with PCI DSS guilelines.
And Wild Apricot doesn't store any credit card information on it's servers - it's all kept at secure vaults of payment providers.

I agree with this especially since WA is pushing their payment system. How is the credit card info stored; unencrypted text? I’m actually a bit concerned about paying my membership dues through WA if this is the care taken with my password, PCI-compliant or not.

I just joined an organisation using this platform and was horrified that a password was generated for me, and then sent to the email address I used to register with and a link directly to login. As far as minimum levels of security goes this is a spectacular fail.

I then tried to change my password, and the UX around this is _horrible_; no indication of max/min length, no indication of chars allowed, and the failure message for a password which is too long is that the password is too short... This really does beg the question, how are passwords being stored, and why are char sets restricted. In my opinion, this is just horrific.

1) Never set a user's password - they should be allowed to set their own
2) Never restrict the length or allowable chars for a user password; there's simply no need
3) Never, ever, ever, EVER, send a password in plain text to the email address registered; bonus negative points for providing the login link in the same email.

The fact that this idea was proposed nearly 2 years ago and still hasn't been implemented is extremely worrying - this shouldn't be a 'nice to have' on a wishlist - this should be absolute minimum level of development with security in mind.

The followup question is "Do they store passwords in plaintext as well?"

+1 for eliminating delivery of passwords in plaintext without a forced reset or expiration.
The {Password_Reset_URL} workaround is useful.

Thanks for feedback. We agree that this is not the best solution and right now we are working on the better option for setting up the password for the new contact.

If you don't want to send password as plain text in the email, just remove the {Contact_Password} macro from the Password email content and include the Password Reset URL macro instead.

Katya, Astra crew
Membership management @ Wild Apricot

Wild Apricot sends user passwords in plain text?

Agree -- WA will be more attractive to professional organizations and associations if they could take care or this!