9

I'm developing a registration system for a project I'm working on.

Since users tend not to sign up if the process is too long, I've thought to require (at least initially) just their email, where I would send them their automatically generated password (and that would also allow me to verify their email address). That would also prevent them from choosing a weak password in order to complete the registration fast.

I haven't found any downsides so far, but I'm afraid there are some as I've never seen a site using this system.

Is that a good idea?

PS: of course I'm also implementing sign up via Facebook and other similar services to allow people to sign up fast without the need of a password, but many may want to choose the classic sign up for privacy concerns or because they don't use any of those services.

  • 3
    It sounds brilliant, the only thing I would worry about is passwords being too hard and people not remembering it. So I would add an initial screen to change password when your users first login. – Alexus Jun 30 '15 at 18:12
  • 1
    Or, rather a suggestion for them to change so it's prominent that they can anytime they want, but myself, as a user I wouldn't change my password right away, may be next time I login. – Alexus Jun 30 '15 at 18:18
  • 1
    I don't think it will hinder sign up, but as a user I do see it as a hindrance because once signing up I will then have to go change my password to one I choice. Unless you don't offer that option, and that would be even more frustrating. – Last1Here Jun 30 '15 at 18:20
  • 5
    By sending the password to an email, is considered a security issue. My personal approach on this is that upon signup the user does not provide (or get) a password at all. He logs in to the application and he receives a verification email. On the verification page you ask him to set a password for his account. – Tasos K. Jun 30 '15 at 19:08
  • 2
    Nah, I think best suggestion is from @TasosK. - you just log a person n and send confirmation email. In that email ther eis a link similar to password reset link that does both: confirms email and prompts user to enter password upon clicking that link. – Alexus Jun 30 '15 at 20:31
13

The problem is that a password should appear in plain text as rarely as possible.

In your case, the password appears in plain text in an e-mail. This has several drawbacks:

  • If the account of the person is compromised, the hacker gets access to your website as well.

  • If there is a malicious man in the middle, he can access the password with ease.

Moreover:

  • Auto-generated passwords are difficult to remember, so instead of making the life easier for your users, you are making it more difficult and at the same time encourage to write down the password on a Post-it, which may not be the best thing in terms of security.

This is why most websites which generate such passwords during registration make them one-use passwords. In other words, the user receives an e-mail with a random password, but once he uses it to log in, the website immediately asks for the new password chosen by the user, preventing the three drawbacks mentioned above.

  • 2
    "If the account of the person is compromised, the hacker gets access to your website as well." That will always happen, at least if you have a password reset - which you most likely will have. – kat0r Jul 1 '15 at 7:49
  • 1
    @kat0r: yes, in general. There are still some marginal cases where it's not the case. One case is when a hacker can just configure the mail account to forward all e-mails to him: he can't ask for password reset, because this may look suspicious for the owner of the e-mail account. – Arseni Mourzenko Jul 1 '15 at 9:20
  • Also bear in mind that the super-duper auto-generated password might not actually be any more secure than a good user-generated password : xkcd.com/936 – CD001 Jul 1 '15 at 13:12
  • @CD001: that's why using randomly generated passphrases instead of randomly generated passwords was suggested, with the benefit of being much, much user friendly. – Arseni Mourzenko Jul 1 '15 at 15:11
4

Honestly, there is not much value to it.

1) Most people use their own password that they remember. If they do, then making them change their password will take longer than filling up an extra field during registration.

The benefit of your system may be that by then the user is registered so you'll not lose it.

2) If they use a password manager it is easier to just make the password manager fill in their preferred username and a random password with 1 click than having to edit the file afterwards and inserting your generated password (likely to take 3 or 4 clicks extra).

3) The current system is so widely used that some people will be confused by the lacking of a password field (like I did with google, but it's google and I trust it).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.