There are two parts to the changes. One is random username generation, which we are shortly going to switch to default off because you are right, it’s not a great default for all communities.
The second part is using email codes for account validation and logins. This is better than magic links in emails and arguably better than passwords. If not better, simpler. Here’s how the flow goes:
- user signs up, we send a code to their email and show the code input on the page
- user sees code in email, enters in Discourse (can see email on a separate device and continue on same device)
- same for logins
- in both cases, they can have no password at all if they wish, password input is optional
- 2FA can still be applied to the account as a second layer
- other signup requirements (additional user fields, captcha) still apply as well, as configured