I am designing a service that would, among other things, store sensitive information. To ensure no unauthorized access of this information, it would be encrypted with a key derived from their password (PBKDF2). The password will be stored in a BCrypt hashed + salted format in the database. It is never stored in plain text.
The nature of the saved information is such that a strong password is necessary. Some websites force their users to make up passwords with large entropy by enforcing strict character guidelines. These complex passwords can lead to password reuse on different websites . This is A Bad Thing™ .
I would much rather have my users select a password that is both strong and not very likely to be reused or already in use on another, less secure web service. As such, I was thinking of using an XKCD-like  password scheme for my users in their native language.
The user would be presented with 4-5 different words from a large word list with more than 6 characters (no words with special characters included, just ASCII). The password input dialog would be formatted with 4-5 fields instead of the normal single field, to reenforce the passphrase paradigm. Upon registration the password can be regenerated at will, to give the user the ability to select a passphrase consisting of words that they can easily remember. The user can not enter their own words.
I know from personal experience that CreeperHost  already uses this method, albeit with a single password field with four concatenated English words.
My questions are as follows:
- Would this method be more secure/effective than allowing users to pick their own?
- Does anyone have any experience with implementing a similar scheme? Was it effective?
- Is dividing the password field into more than one distinct field benificial or does it expose too much information?
I am looking specifically for answers related to real-world application of this specific method, if there are any. I am familiar with the theoretical strengths and weaknesses of this method of password generation.
- The Tangled Web of Password Reuse - http://www.jbonneau.com/doc/DBCBW14-NDSS-tangled_web.pdf
- Password reuse - http://xkcd.com/792/
- Password Strength - http://xkcd.com/936/
- Creeperhost - http://www.creeperhost.net/