SimplePasswordMechanism

Hello all,

While reading TWikiPasswordStrength, I do agree with that (would be helpful). But at the same time it prompts me to raise this discussion. I run a number of different TWiki sites, for different purposes. Some of them are for business & serious matters, where TWikiPasswordStrength is important. However, other sites are for personal use and passtime.

On the less serious sites, TWikiPasswordStrength is actually a problem, because:

• non-techy users find TWiki too complicated & confusing to begin with
• non-techy users cannot remember the many complicated passwords that they already have
• even ResetPassword is too complicated for low-tech folks
• the ID & password on a low-security site is meant for identification purposes only, not for security

As a result of the above, TWikiPasswordStrength actually inhibits use on low security sites and causes folks to avoid using them to the fullest extent. So in addition to the need for TWikiPasswordStrength on high security sites, I would suggest that it is also useful to enable the possibility of SimplePasswordMechanism on low security sites.

SimplePasswordMechanism would be used only in cases where:

• nothing important is being secured by the password
• password is only meant to identify the user, for voting and making comments, etc

SimplePasswordMechanism would make the user ID + password mechanism as simple as possible, for example:

• TWikiRegistration is drastically simplified
  • no customization of WikiName ( hidden, and automatically generated based on first & last name)
  • email address is offered as automatic suggestion for loginname during TWikiRegistration
  • TWikiPasswordStrength is customizable, but allowed to be weak and simple
  • everything else that is possible is done with the user's convenience & simplicity in mind
• ResetPassword is also simplified
  • sends an authenticated link to the ChangePassword page, thus reducing the thoughts & number of steps required

These are just some ideas, to get folks thinking. I hope they are helpful and could be implemented someday as an option, for example in LocalSite.cfg

-- Contributors: KeithHelfrich - 25 Oct 2008

Discussion