# Warum ist bei der Anmeldung immer noch ein Passwort erforderlich?
**URL:** https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915
**Category:** UX
**Created:** [14. Juni 2018 um 19:47 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915 "2018-06-14T19:47:11Z")
**Posts on this page:** 19
**Page:** 1
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [14. Juni 2018 um 19:47 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/1 "2018-06-14T19:47:11Z")
Just wondering: now that discourse supports login via email, is there any reason why password is still required at signup?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [14. Juni 2018 um 21:52 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/2 "2018-06-14T21:52:22Z")
I don’t understand what you are asking? You want to _prevent_ people from logging in with username/password? If that’s what you want, disable local logins altogether and use SSO or social logins exclusively.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [14. Juni 2018 um 22:01 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/3 "2018-06-14T22:01:48Z")
> [@codinghorror](#):
>
> You want to _prevent_ people from logging in with username/password?
No, I want people to be allowed to create a new account without providing a password.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [14. Juni 2018 um 22:08 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/4 "2018-06-14T22:08:00Z")
We have no plans for that at the current time. You’d be reducing from two factors (control of email address + knowledge of secret string) to one (control of email address).
---
### Author:  [@tannerfilip](https://meta.discourse.org/u/tannerfilip)
#### Post date: [14. Juni 2018 um 22:28 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/5 "2018-06-14T22:28:22Z")
This is _kinda_ possible. Mozilla did it with [Auth0](https://auth0.com/) (a third-party service) and a [custom plugin](https://github.com/mozilla/discourse-auth0-mozilla), so we have regular username/password login disabled.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [14. Juni 2018 um 22:52 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/6 "2018-06-14T22:52:13Z")
> [@codinghorror](#):
>
> You’d be reducing from two factors (control of email address + knowledge of secret string) to one (control of email address).
I must be misunderstanding something. I was thinking that if people can have a magic login link delivered to their email, why should they have to bother coming up with a password when they sign up (i.e. a password that they will never need)?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [14. Juni 2018 um 23:07 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/7 "2018-06-14T23:07:30Z")
You are denying them the second security factor of a secret password string at that point, though. I agree that if their email is compromised they are hosed either way, since a password reset can be issued via email.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [14. Juni 2018 um 23:11 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/8 "2018-06-14T23:11:29Z")
> [@codinghorror](#):
>
> You are denying them the second security factor of a secret password string at that point, though
No, not denying. Just not requiring it.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [14. Juni 2018 um 23:12 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/9 "2018-06-14T23:12:28Z")
The other downside is that if you lose control of the email in that scenario you literally can’t log in. Whereas if you lose control of email with a password on your account, at least you can log in to the website and PM the staff to help fix it (associate another email).
---
### Author:  [@featheredtoast](https://meta.discourse.org/u/featheredtoast)
#### Post date: [14. Juni 2018 um 23:25 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/10 "2018-06-14T23:25:44Z")
I actually kind of like the idea of not requiring passwords. It gets rid of some of the hurdles to create a new account in the same way oauth does. Oauth already doesn’t require a password for new accounts - if a user only signs in with oauth and loses access to the oauth account, same boat.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [14. Juni 2018 um 23:30 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/11 "2018-06-14T23:30:09Z")
Are you aware of any large-ish mainstream site that has done away with passwords on local accounts entirely? I’m not..
---
### Author:  [@featheredtoast](https://meta.discourse.org/u/featheredtoast)
#### Post date: [15. Juni 2018 um 00:06 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/12 "2018-06-15T00:06:44Z")
I’m actually annoyed that I’m finding nothing to answer your question. Auth0, for all it [brags](https://auth0.com/blog/is-passwordless-authentication-more-secure-than-passwords/) about how [passwordless](https://auth0.com/passwordless) is [the future](https://auth0.com/blog/analysis-of-passwordless-connections/) still requires a password to signup on its own site. So I suppose this is only a pipe dream.
For sites that don’t offer oauth and offer sign-in email and I can’t be bothered to add the passwords to a manager, I type garbage in the field just to have something, and rely on the reset password/password signin links. It’s functionally the same (for me) as having no password.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [15. Juni 2018 um 00:16 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/13 "2018-06-15T00:16:05Z")
> [@featheredtoast](#):
>
> I type garbage in the field just to have something
Don’t do that, use the browser autogen password features.. this is enabled in all new Chrome browser versions as far as I know. Right click to trigger.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [15. Juni 2018 um 00:48 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/14 "2018-06-15T00:48:55Z")
> [@codinghorror](#):
>
> The other downside is that if you lose control of the email in that scenario you literally can’t log in. Whereas if you lose control of email with a password on your account, at least you can log in to the website and PM the staff to help fix it (associate another email).
So requiring a password is useful only for people who know their password and lose control of their email address. That seems like a pretty small set of circumstances, as in my limited experience, people who have lost control of their email address usually don’t notice until they try to reset their password. 😉
> [@codinghorror](#):
>
> use the browser autogen password features
Cool! I can stop pseudo-randomly whacking my keyboard. (But the people that I’ve been dealing with on a new migrations aren’t capable even of whacking random keys on their keyboard. They’ll never find that generate password thing.)
---
### Author:  [@erlend\_sh](https://meta.discourse.org/u/erlend_sh)
#### Post date: [16. Juni 2018 um 06:27 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/15 "2018-06-16T06:27:38Z")
> [@codinghorror](#):
>
> Are you aware of any large-ish mainstream site that has done away with passwords on local accounts entirely?
Definitely on the ish-end of large but: [https://opencollective.com](https://opencollective.com)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [16. Juni 2018 um 07:39 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/16 "2018-06-16T07:39:01Z")
That is a reeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeally generous interpretation of the word “large”.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [16. Juni 2018 um 08:45 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/17 "2018-06-16T08:45:13Z")
> [@codinghorror](#):
>
> use the browser autogen password features…
But that will also save the password in the browser’s keychain, right? Not the safest thing to do.
And: mobile. In fact, for me this passwordless thing is mainly about mobile. I use keepass on all my desktops but generating and saving a new password on mobile is still a pain (and probably will be for a long time).
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [19. Juni 2018 um 04:47 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/18 "2018-06-19T04:47:01Z")
It is bad on mobile but not terrible if you are using lastpass (or are locked into the safari world), cause it integrates into safari, so I can simply “fill password” in two clicks.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [19. Juni 2018 um 05:33 UTC](https://meta.discourse.org/t/why-is-password-still-required-at-signup/89915/19 "2018-06-19T05:33:12Z")
> [@sam](#):
>
> I can simply “fill password” in two clicks.
I’m using keepass (also on mobile) and it works fine filling in existing passwords. Are you saying that Lastpass also allows you to _create_ a new password in two clicks?