Ask HN: Should I generate passwords for new users instead of asking for one?

5 points·namdloytrrid··10 comments

By generating passwords for users at registration, I would only have to ask users for their email (I'd email them a password they could change); thus, making registration simpler. However, doing this either requires the user to change their password or remember/look up a randomly generated password, possibly discouraging repeat visits.

View on HN

"possibly discouraging repeat visits." --- you nailed it on the head yourself, that seems to outweigh any minor benefit from having one less field to fill out at registration time.

Even worse, if the password e-mail gets spam-filtered or even just delayed a bit, your user loses interest waiting around and just goes to another site which will give him instant access.

I hate that. I almost never end up changing the password and it's a pain in the ass to look it up each time. Just ask me for it up front.

How about using OpenID?

If you're trying to limit the sign up form to two fields, you can do it the hackernews way, just ask for an email and a password. Just a suggestion.

I think that e-mailing a password for them to change adds another step, instead of taking one away.

Not unless 99% of your users are one time users. Otherwise there are more steps, not less.

Emailing them a password means you have their plaintext password. Please never do this.

Or it means he emailed you the generated password right before hashing it and never actually saved it in plaintext.

You can send out the email and then immediately hash it. It's still bad form though.

Use OpenId

Reply on news.ycombinator.com