How can I enforce strong password policy with non-technical user base?

Question

I've been using zxcvbn to enforce strong passwords for a service where break-ins would cause considerable problems. However, the service is only viable if many users sign up. We've found that users are inclined to walk away in frustration when zxcvbn rejects password after password (based on both website metrics and in-person events). We started with zxcvbn's strength at 4 and have since reduced it to 2, but the problem persists.

It's become painfully clear that your average Jane is used to creating bad passwords and has no interest in being retrained. We don't have the budget to take on responsibility for that kind of social change, and the powers that be are pushing hard to go back to something like "8 characters, at least one number, etc." It's understandable from the business perspective - we spend more time coaching users through the password creation process than we do talking about our service.

So, what's the next best way to enforce a password policy that doesn't leave us with a slew of easily hacked user accounts while at the same time not alienating a non-technical user base?

Edit: Logins happen though web interface as well as others such as IMAP which makes anything other than password-only logins unlikely to be viable.

Answer 1

Do you have the option of adding 2-Factor authentication to your site? Here's the first article that came up when I googled "using google authenticator on your site".

If this is a corporate network and your users are your employees, then you have the option of using physical tokens like smartcards plugged into their desktops, or grid cards.

From a social engineering / design perspective, can you find a way to use a carrot approach rather than a whip approach? By that I mean give perks to users who have strong passwords (in a way that's not visible to other users, otherwise it's equivalent to public shaming for weak passwords which is actually worse). Maybe a small discount on membership fees or purchases, or in-service perks like small vanity features, more storage, priority queuing, wtv. I know MMOs have used this to great effect to help encourage the adoption of 2-Factor keys and strong passwords.

Answer 2

I assume this is a web-based service. (I am not familiar with zxcvbn).

One option would be to do away with user-visible passwords entirely. If you can get users to sign up using their email address, you email them a link with a unique id. When they click that link, a strong cookie is set in their browser.

'Password resets' consists of emailing them a new link.