Registration form inline password generation?

Question

A client has given me "design direction" for their site's account creation form (it's a utility site) that includes an option to have the system generate a password for the user inline on the form, adjacent to the password field. My gut says that generating a random password will actually result in forgotten login troubles later - especially since it's a utility site the user will likely only log into once a month - but I can't find anything to back up (or debunk) my suspicion. Anyone seen anything, or have a well-informed opinion on whether/how inline password generation affects login success rates? Thanks in advance.

Answer 1

As your client is likely wanting to produce a password for the user to avoid them selecting a commonly weak password:

Why do people keep doing this!? Because they can remember them!

It might be helpful to point out to your client that The Only Secure Password is the One You Can't Remember.

The above article points out many tricks to creating passwords, such as Google's suggestions in this YouTube video: https://www.youtube.com/watch?v=0RCsHJfHL_4

Which both the article and this xkcd strip quickly debunk as being at all useful:

In giving the user a meaningless random "strong" password, they will immediately defeat its purpose by writing it down; or changing it to something they will better remember.

Commonly cited principles of short-term memory include George Miller's Magic Number 7, in which people can retain 7 +/- 2 items in short term memory at a time. Additional are multiple studies that have shown that memory lasts between 15-30 seconds, without rehearsal or some other memory aid.

Given an 8-digit random "strong" password, absent of personal context, the user may hold onto that memory long enough to hit the submit button -- unless they are asked to remember something else along the way. Beyond that it will quickly fade without employing a retention tactic, such as rehearsal or repetition.

Prove it to them...

You could easily demonstrate how difficult this will be to users. Give your clients a flashcard with the random "password" on it. Don't hide what you are doing and give them a chance to try and remember it; 2-5 minutes. Then continue your meeting with them. At the end of the meeting (let's assume a 30 minute meeting), ask them what their password is.

If you are remote to your client, you can do the same in an e-mail. Give them a random password in an e-mail and tell them to remember it. A week later, ask them what it is. If they're honest, they'll tell you they had to go look in their e-mail (probably).