Ability to create account with email address

[a1270]

This is made even more stupid by the fact you are required to provide an email to complete the registration. An email address which cannot be changed/removed and isn't displayed anywhere on the account settings.

Stating what you are doing with the collected email addresses in the TOS is a necessity at the least. What exactly are the email addresses being used for? Will they be sold to 3rd parties?

tl;dr
you are already collecting email addresses and asking for user names. There is little reason we need to be forced to compromise privacy/security by linking to a 3rd party site.

[JustMaier]

The reason we didn't include email/password accounts is because we didn't want to deal with sending emails for things like password reset. By only using other authentication providers we can avoid the support hell that is "I can't get into my account," instead that's all shifted to the services you can login with.

As for TOS and emails, we didn't include anything because the TOS we based ours on (Hugging Face and Imgur) didn't include anything about it either. We don't currently have any plans to use email addresses, but they are used by the authentication package we use (NextAuth) to ensure accounts are unique.

I don't like email. I don't like getting it and I don't want to send it. I'll dig into our authentication system to see if there is a way for us to disable the need for an email all together. Would that be a reasonable resolution for you?

[a1270]

I don't like email. I don't like getting it and I don't want to send it. I'll dig into our authentication system to see if there is a way for us to disable the need for an email all together. Would that be a reasonable resolution for you?

That seems reasonable. I am rather anti-3rd party auth as i had a ton of issues when OAuth was supposed to make logins a thing of the past. All it meant was when a provider went down it was like pulling teeth to get your accounts working again. Transfers were always promised but that didn't matter when the server was just shut off. But I do see the appeal of of just having another site handle it for you. Logins always cause issues.

thank you.

[LumiWasTaken]

I fully support the idea to intruduce an alternative method.

So far the whole civitai as a centralized place is cool but on the other side i avoid it like the plague since having everything connected with eachother is not cool. Maybe not because of civitai using it maliciously but rather reddit now having a connection between those two accounts.

The most simple thing would be to only have, usename and password and email for recovery only as optional.
If people dont want to add an email, then dont let them.

Alternatively make it social media 0Auth login and only username and password but putting a large disclaimer there that if you choose a username and password without a 0Auth method you risk losing your password without an option to reset it.

Dont make your personal preferences a user issue. "i dont like emails" is not a valid way to talk your way out of a world that is relying on email as its the most robust atm.

[JustMaier]

Totally fair, I shouldn't put my distaste for email on everyone else 😛

Good idea regarding the username/password recovery. I'll discuss it with the team

[ghost]

Nice, I was just about to create "Change password functionality" ticket, but you seem to have already discussed this. Either way, it feels weird to have email/password to authorize and also have no way to reset active password. Hope the issue is still on! 🙏

[JustMaier]

This is live! You can now login with an email address 😊

[Vigilence]

I tried to create an account, but no activation email was sent to me. Can't find anything in the spam folder, waited a 2 hours.

[GregHilston]

Same thing is happening to me as well

[JustMaier]

We'll be upgrading our email service provider today. That should help quite a bit with deliverability. I'll reply here as soon as that's done

[JustMaier]

Ok, we've just changed email providers. Can you give it another try?

[ostap667inbox]

Sorry, but the authorization system on the site can hardly be called adequate.

1. There is no password recovery system.
2. I forgot the email I used to register. I enter one of my emails at random and a new account is immediately created for me. The modal window requires me to make up a login and agree to the terms and conditions. I can't even close it to unlog out and try to sign in again! What an idiotic thing to do!
3. Going into my account settings I also can't see exactly how I'm logged in, from which email address. What the hell?!

[ostap667inbox]

Here, I know my nickname, but I don't remember my email. How do I regain access? All of them? I lost access to my models?!

[jhlchu]

Also, every time you guys 503 it de-auths the OAuth token and logs me out of every civitai page in tabs. And you guys been getting 503'd alot recently.

[WASasquatch]

Should be able to just refresh. Never been actually logged out of CivitAI in months... That is, I've never logged in but when I registered.

[space-nuko]

I dunno if passwordless login is a good tradeoff, issue for me is the UX is disruptive

1. I see a model I want to download, but Civit gates it behind their login because it's marked "sensitive"
2. Okay so I can log in, but I can only do so from email, so I have to pull myself away from the login screen all the way to my email which I'm usually not logged into
3. Then I have to dig through my inbox to see if the login email was delivered
4. The most annoying thing, the login link does not redirect to the model I wanted to see, it goes to the home page! I have to go back to the original tab instead, the tab opened by the login link is essentially useless
5. Then refreshing the tab that blocked me from seeing the model to begin with redirects to the home screen after I've logged in too! I have to be careful to go back in my history to land on the model page
6. Finally I can look at the model.

Whereas if you let us add passwords, the process is

1. See gated model
2. Go to login, autofill username and password, submit
3. Be redirected to model page

And yes, the API technically allows you to bypass the gating mechanism, but I don't think most users are going to bother to work around it

If as you say you "didn't want to deal with sending emails for things like password reset", "don't like email", "don't like getting it" and "don't want to send it," then why do every time you make users to have to login to browse a model you send them an email? Seems like it adds more friction to the process than is necessary. I'd rather deal with needing a password reset once or twice than having to put up with going through an email flow every single time I need to login

And personally I do not want to have to use a social account to log in, it's a privacy concern from my standpoint

[crkinard]

Love how there is now an e-mail login (hate sites that force you to link through social media which I avoid). but the e-mail never shows up. Or at least waiting 15 minuets and it still has not arrived.

[Shahius]

So...
It's May 2024 and you still don't have password system?
Just registered with my email and was looking for Change Password option in my account.
Nothing. Nada. Zero.
How come this site doesn't have simple basic functionality?
It feels unsafe to me (doesn't mean it is REALLY unsafe, but this feeling is very unpleasant, like you don't have control). Just gross.
This is why I am going to look for an alternative, so far...

[WereCatf]

It's quite frankly entirely irresponsible that you allow people to add payment methods and all, but no way of changing email address or password or anything. If someone were to get ahold of the account, there'd be basically nothing you could do to thwart them aside from deleting your account, it seems.