Part of a series of reforms for the login system, this patch would ideally allow users to define their own password during registration, a feature that has previously been provided by the LoginToboggan module.

The login functionality applies to all Drupal installs, and this usability feature seems to me to be applicable to all Drupal installs and therefore the 6.x-dev core.

NOTE: I have no coding skills whatsoever, however, I hope I can contribute my ideas and hopes to Drupal.

Comments

jjeff’s picture

jjeff commented

+1 on concept, but this is going to require some major changes to the logic behind how the Drupal registration system works. Basically, we will no longer send the user their password as their authentication, but instead we will send them a unique code which they will use to authenticate themselves.

Is this essentially what's happening with the "one time login" URL that's happening now? Perhaps we could abandon the whole "or login using this randomly-generated password" part of the email.

Are there security concerns that I'm missing?

jjeff’s picture

jjeff commented

...also...

A contingency will need to be planned for what happens when the user tries to log in with their (correct) password to an account that has not yet been authorized. Do we give them some sort of intermediate "non-authenticated" role and display a message on every page? Do we deny their login and tell them that they need to authenticate? The logic behind all of this stuff will need to be carefully thought out.

birdmanx35’s picture

birdmanx35 commented

I think Drupal should add a pre-authorized rules with either the same or a little better privileges as an anonymous user. If they logged in, they wouldn't be able to do anything, and would receive a "don't forget to reauthorize, do you want a new link?" message.

At least for me, this has been one of the major problems with Drupal. Drupal's login structure is not intuitive to the average computer user. I've had many a complaint about people saying "I can't remember that weird password" because they didn't realize they should change their password upon logging in.

Would it be possible to make this a setting, where you could change it back to randomized if you felt that was a better setting?

Crell’s picture

Crell commented

Also remember we have to keep support for sites that require admins to approve a pending application. I'm designing one of those right now. Giving people 2 passwords, in essence, only makes the login and registration process more complicated.

I currently maintain another system (not in Drupal) where users define their own password when they apply, and then a human reviews the application and approves it. There could be a delay of anywhere from 24 hours to a week, depending on how on the ball that human is. A very common problem of ours is that by the time people have been approved, they forgot what password they used and have to request that it be reset (which is also a manual process right now). I want to replace this system with Drupal. :-)

The root of the problem, I think, isn't that people need 2 passwords. It's that they forget that they should change their password after they log in the first time. The solution is to allow the admin to set a flag to require people to change their password on their first login. That way there's no place for them to forget what they put in, other than the one we obviously can't control. They still have only one password at a time.

birdmanx35’s picture

birdmanx35 commented

This wouldn't actually give two passwords: only one, human-accessible password.

However, I agree, we need to make sure such sites can use this. How does this change this issue's outlook?

Crell’s picture

Crell commented
Status: Active » Closed (won't fix)

Logintobaggan offers this if anyone wants it.