Extension talk:ImportUsers

passwords

Hi,

thanks for this extension. I've been using it for a while with satisfaction.

Still, something has been bugging me for a while. I find that neither sending to the admin a clear password nor the admin setting an easy modifiable password, which will be modified by 20% of users is either secure or privacy friendly (how many users still have the same password for different services).

It would be so much better that if the password is left blank, the system resets the password like when creating an account from the standard interface. This should not be too complicated to implement (owing to the hook linked above).

Thanks in advance @WikiTeq team ! 😊

--Loizbec (talk) 10:09, 8 October 2025 (UTC)

Thanks for the suggestion! We don't plan to implement this, but we'd be happy to review and merge if someone wants to create the feature. Ike Hecht 18:57, 20 October 2025 (UTC)

Passing on a note from the WikiTeq team:

Your reluctance to email users a password in plain text is understandable, and wanting users to need to set the password themselves makes sense. Instead of having that be a part of this extension, however, have you considered simply not telling the owners of the imported accounts what their passwords will be set to, and directing them to the site’s built-in Special:PasswordReset page? If they know the username (which is not sensitive and can be sent in plain text via email) they can submit a reset request and get an email with a random password. Ike Hecht 19:21, 7 November 2025 (UTC)