Make installation form pluggable (was: allow user to set password)

[markjaquith]

There are a few things about WordPress' handling of passwords that annoy me.

==Default Password==

When WordPress is installed, a random password is created. It would be nice if the user, upon logging in for the first time, was prompted to set their own password.

==Password Reset==

Resetting a password takes too many steps. There are two e-mail verification steps, when one would do. Once the initial verification link is clicked, the user should be provided with the new password (on the page, not just in an e-mail.) They also could be provided with a "set your password" form allowing them to set the password to something they'll remember, so they're not doing this again the next time they want to blog from the library.

[darkfate]

Instead of asking the password on install, why not put it in the form when you install. No sense having an extra redirect.

[darkfate]

oops. I meant instead of asking the password AFTER install.

[darkfate]

I don't think we should allow the user to make his/her password by default since it can be insecure. See #2910 which encompasses both username and password.

[darkfate]

I guess I'll just leave it open to discussion.

[masquerade]

I don't think we should allow the user to make his/her password by default since it can be insecure.

This is the worst argument I've heard for not including this feature over the years. If a user wants a dumb password, they will go in and place a dumb password. Set a secure default all you want, but a stupid user will go in and use their stupid password regardless of what you set.

[tenpura]

WP does not have these common password checking function, does it? It will improve the security of WP a bit.

• a password should be different from its login name (admin:admin is no good)
• a password should be long enough (at least 5 or 6 characters long?)

[Viper007Bond]

+1 for allowing picking of username/password during install. I hate having to go in and change the login of the original "admin" account after installing WP.

[darkfate]

I'll use the patch that I made for #2910 and add a password input field. The password reset will be a different patch. Anyone want to do that patch?

[darkfate]

allow user the select username and password

[darkfate]

I need some to test those patches. The reset password still sends two emails. The second email just sends what your new password is. Just so you can keep it in your email. You put your new password in the same lost password form, then it sends the verification link. That verification link leads to the page which tells you that you your new pas (that you set). I guess the second email isn't nescarry because the user set their own password, but I'll leave that up to everyone else.

[masquerade]

-1 on passwords being sent plaintext in email at all.

[darkfate]

allow user to reset password with one form, updated: took out second mail with password

[matt]

Passwords are sent in email (and should continue to be) because that's how people look them up and save details of different accounts.

[markjaquith]

Is there any reason that the password can't be (additionally) provided in the browser after clicking the confirmation link? At that point, your ownership of the e-mail account is assured, so why force them to check their e-mail again?

[darkfate]

That's what my patch does. Once you click the confirmation link, it shows you your new password in the browser. I also agree with masquerade when he says that sending emails with a plain text password is risky. The whole point of setting your own password is so that you don't forget it. You shouldn't need to keep an email reminder. With the patch I made, it's a lot easier to make a new password if you need to.

[masquerade]

Out of curiosity on a comparison of how many other web applications do this, I searched my primary inbox for the past couple of years, a few thousand mails, including everything I ever signed up for, for my passwords. 9 results came up total, which I know is tiny compared to how many places I have signed up for. A few offenders are dreamhost, newegg, and a few other places I buy hosting from. Nothing from any forum, blogging site, etc.

Really, to me, encouraging users to save their password in their inbox is encouraging more and more lenient security policies. I'm not saying that some fool might do it anyways, but we shouldn't facilitate people trying to do something foolish, and anything that shows you the password you just created is included. You should have to type it twice to confirm you know the password, we shouldn't have to tell them what they just typed twice, I'm pretty sure they know what they just put.

[darkfate]

So, can this be commited to the trunk? Or should more testing be done.

[darkfate]

Hmm. So is this going to make it into the 2.1 release. Or is this for the 2.2 release?

[markjaquith]

Reinstate the second e-mail with the password (in addition to showing it in the browser), and this is +1 for me.

[pishmishy]

I hope no one minds me taking ownership. I've got some ideas for this ticket that I'd like to work on.

[pishmishy]

Makes installation form pluggable

[pishmishy]

The patch I've just attached allows you to easily add new input elements to the installation form. wp_install is already pluggable and can be changed to make use of any new inputs if necessary.

Using my patch, a password box for the installation can be added in a few lines of code. Suggest that the password reset aspect of this ticket is separated to another ticket.

[pishmishy]

Created #5919 for Password Reset Aspects. Renaming accordingly

[pishmishy]

Note: wp-content/install.php is the place to overwrite wp_install()

[darkfate]

I like this idea. I can't believe I did that three years ago. The hooks are a better idea though.

[neoxx]

-1 for sending any passwords (except temporary ones) in plaintext via e-mail. - if one forgets his password, he can use the password lost function.

[neoxx]

another thought: why not sending an activation-code instead of the password itself? besides the increased security, this would also verify a newly registered e-mail address and therefore keep most of the spam-registrations out...

[hakre]

on wishlist30 for ​neoxx

[hakre]

Related: #10006

[neoxx]

Replying to matt:

Passwords are sent in email (and should continue to be) because that's how people look them up and save details of different accounts.

While writing a post about my last five years WordPress, I came across this Wikipedia-article ​http://en.wikipedia.org/wiki/Password#Procedures_for_changing_passwords

In the last four years (since Matt's comment) a lot has changed and maybe we should re-think this sending of plain-text-password-emails.

Instead, upon verification of the email-address we could make use of the password strength meter or assign a random password. Anyway, if the user forgets the password, we already got the handy mail-function to request a password reset...

[RyanMurphy]

Does the Password Reset part fit into the scope for 3.1?

The Default Password part no longer applies, since the user is able to set it when they install WordPress, and users created after it is installed get the nag notice.

[hakre]

Related: #14943

[johnbillion]

The simplified password reset functionality introduced in 3.1 means both points raised in this ticket have been addressed.

[dd32]

Marking as 3.1 based on johnbillion's comment.

[hakre]

Related: #16911