After the tenth email from haveibeenpwned.com, I swore to never hand over a username and password to another forum system. Even one run by "hackers" (in the positive sense). This holds especially true for phpBB.

Let me log in through an external service where I can control my credentials and factor count. Ideally a pile of established OAuth providers and an open OpenID box.

Use a different password for each phpBB and other forums. Manage them all using LastPass or some other password manager.

If they get hacked and you lose that password, so what? They can only impersonate you on that forum.

Great until the password manager has security issues. They're still passwords so even after they fix up shop, you still have to [very manually] go from site to site replacing your passwords. Until you do that, you, your data and your online persona may be vulnerable somewhere.

If an identity provider has issues, the window of opportunity ends with the rollout of a fix.

Not to mention that I trust the security of my identity provider a lot more thorough than Mr Bobbins phpBB instance. Audits automatically instigated by changes in country, ISP, device, browser. Logs kept. Dynamic secondary and tertiary factors.

It's toxic and unnecessary data. Let somebody else handle it.

Then only use that password manager for PhpBB forum...

You care way too much for an account that you currently don't even have... is is really necessary? Worse case, you lose it and you are back a your current state, doesn't seems so bad to me.

> currently don't even have

And won't have with the current login method.

I'm not trying to convince you to follow my path here, I've just been trying to explain why I do what I do, in an effort that the guy advertising a forum I'm interested in might improve things enough to let me (and those like me) in. I understand that there are ways to do this, and that my way is an active choice.

If it comes to it, I'd rather go without.

That’s funny, I would never trust an unknown site like this with my real OAuth or OpenID account. Too much risk of compromise or marketing or whatnot.

I use a system of unique ids for these sites.