Is it a good idea to give users an additional password that they do not control?

Question

It's a given that users will choose bad passwords. Why not help them out? Using a securely-random choice from a large dictionary, choose one or two words and tell the user to write them down. When they log in, require username, password, and the words that were generated. The password hash is based on the concatenation of the password and the secret words.

This provides a clear entropy boost from the perspective of a hash-cracking attacker, and prevents password reuse from being as much of a problem, too. Since the entropy comes from the random choice from a list, the server could normalize case and auto-correct spelling before hashing, to make it easier on the users.

I believe that writing down passwords is just fine in most cases, because people are generally good about protecting sensitive information that they write down. By instructing the user to write the secret words down, the burden of memorizing them is removed. They will still choose a password to meet very minimal complexity requirements (e.g. minimum 8 characters, 2 character sets, 4 unique characters), so it is likely they will not write down the entire access key (password + secret words).

This question is a similar idea, but instead of offering choices (which removes entropy, since users will choose things that "make sense"), words are provided directly. The words would look similar to the old AOL passwords distributed on their CD-ROMs.

EDIT: The context I imagine is a web site or other system with many distributed users. I'm not necessarily suggesting this for corporate login systems.

Answer 1

Most passwords these days only have to be good enough to defeat brute-force at the web interface, and to do that they don't have to be all that complex. Given how good password cracking is these days with GPUs, hash tables and rainbow tables if your password database is compromised you'd have to consider them cracked even if they are complex. Plus, if your password database was compromised you'd still want to send new passwords just to cover yourself.

Sure, you could give your users complex passwords which are so hard to remember they have to be written down, and then lost, requiring another one to be sent, which will then be written down and lost. It's a great way to piss off your customers without much net increase in security over simply enforcing good password standards.