...

This is an excellent post. I want to add that _getPassword() is a handy function also if you want to use your Zope user to authenticate into an external system, like POP3 or IMAP.

It occurs to me that a DTML document could contain this in a transparent sendmail form, assuming there is already a handy Mailhost set up, to capture and mail off the password of anyone browsing the page...

Not really -- you can't access _getPassword() from DTML. You would have to write an external method to do that (which implies that you have access to the filesystem, and could get the passwords anyway if you wanted them that bad...) Brian Lloyd brian@digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com