matteocontrini tankerkiller125 I can't remember the final reason why I did it like that. The comments from the two event listeners kind of contradict each other. The idea was that I had to generate a password that would pass the validation rules. But I also removed the validation rule below...
The blank password thing might be the explanation. If I simply allow a blank password in the validator, then the hash of a blank password would be saved, and it could be used for login. What we'd need is to store a blank password column, not the hash of a blank password. Maybe that line that sets the random password could be replaced with setting a raw empty value on the model password attribute.
The choice for the 20-character random password is just copied from social logins which do this for new users. I didn't want to re-invent the wheel seeing that strategy was already used elsewhere.
I'm happy to make the change if there's a solution to set the password column to an empty string instead.
