Depends on what you’re trying to protect against and who your average user is. Forcing passwords onto users is a sure fire way to get people to write their pas

Depends on what you’re trying to protect against and who your average user is. Forcing passwords onto users is a sure fire way to get people to write their passwords down and constantly get locked out of their account. In some circumstances that’s not a problem. For local domain access, that’s completely unworkable. For websites it makes a little more sense since users can use password reset via email, but if you’re going to expect people to rely on that then you might as well allow them to set a password and use email as 2FA.