0

Do you think it's a valid point, that if a web service holds no personal/security data it should be up to user what password length to haver or even to have no password?

5 Answers 5

1

This depends on what the user account is used for. There are 3 forms used here:

  1. Authentication
  2. Authorization
  3. Identification

If you're concerned either with Authentication or Authorization then you must have a password. Not having a password makes this pointless. If your only goal is identification and there is no real security loss/gain in allowing a user to misidentify him/herself, then a password becomes superfluous. Again, if this is the case, the identification itself becomes superfluous and you should consider allowing open access.

1

What is a password for? It is to help provide authentication. If you need to provide authentication then you need means to do that. A password is merely a tool that assists that.

0

What's the point of having accounts if you're going to allow a user to not have a password? The purpose of accounts it accountability. Not having a password removes that.

0

If you need authentication via passwords, then you need your passwords to be as secure as your site operations are to the users.

0

First off, as the other answers stated clearly, you should always require a password as not doing so defeats the purpose of authentication.

Having said that, why not instead use openID or Facebook Connect? There are way too many sites now that require signing up for even the most trivial matters. Using Facebook Connect or OpenID will give you huge usability points in the mind of users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.