This question came up today while discussing with a colleague about the 'create account' page for the website we're working on.
My colleague's opinion is that we should make the registration as quick and seamless as possible, therefore we should just ask the user for his email and take care of the rest.
I agree with the intention, but I have a few concerns about it:
- Since we generate the password, we have the responsibility to make sure the password is strong enough
- In my experience, when confronted with an unintelligible password, users are likely to write it down on a post it
- The users who do not write the password down, are pretty likely to forget it. Which means they'll have to ask for a new password regularly, and that's not fun for anyone
However, considering the general quality of passwords created by users, and the fact that too many people tend to use the same password for everything ('shudders'), I can see how it would make sense to generate a strong password for them.
I still feel torn about it. We are working on a merchant website where the user has the option to save his credit card details, so it is obviously very important that we use most secure approach.