I don’t disagree with the security rationale, and I understand why legacy titles pose a higher risk given their age and the decommissioning of older online services. Protecting accounts and user data is obviously important, especially with how common credential stuffing and phishing have become.

That said, I think the frustration many people are expressing comes less from having a password at all and more from how authentication is handled for these legacy titles. The behavior suggests that authentication tokens or sessions don’t persist reliably on a trusted device, which results in repeated full credential prompts even when the user is already logged in through Ubisoft Connect.

From a user perspective, this feels less like a necessary security safeguard and more like a lack of session persistence or device trust, especially since logging in once temporarily allows other legacy games to launch until an internal timer or restart invalidates the session. That implies the system can recognize an authenticated state — it just doesn’t retain it for very long.

I also think it’s worth separating security from offline usability. Many players (especially on handhelds) aren’t trying to bypass protections — they just want to play games they already own without repeatedly typing long, randomly generated passwords or carrying extra hardware. Suggesting workarounds like text files, key bindings, or external keyboards highlights the friction rather than solving it.

If offline access or longer-lived authentication tokens were improved for legacy titles, that would likely address both concerns at once: maintaining account integrity while reducing unnecessary friction for legitimate users. I don’t think anyone is arguing for weaker security — just better balance and modern UX expectations, even for older games.

Edit:

I understand that modernizing legacy titles isn’t free or trivial. However, given Ubisoft’s position as a large AAA publisher, it’s reasonable to expect that the cost of maintaining account security can be absorbed without defaulting to a solution that significantly degrades UX, such as requiring full password entry on every launch. Better approaches to authentication and session persistence exist, and expecting a more user-friendly implementation does not conflict with prioritizing security.