Is forcing users to use a strong password effective?

I am designing a service that would, among other things, store sensitive information. To ensure that no one on our side of the is able to retrieve this information, it would be encrypted with a key derived from their password (PBKDF2). The password will be stored in a BCrypt hashed + salted format in the database. It is never stored in plain text.

The nature of the saved information is such that a strong password is necessary. Some websites force their users to make up passwords large entropy by enforcing strict character guidelines. These complex passwords can lead to password reuse on different websites [1]. This is A Bad Thing™ [2].

I would much rather have my users select a password that is both strong and not very likely to be reused or already in use on another, less secure web service. As such, I was thinking of using an XKCD-like [2] password scheme for my users in their native language.

The user would be presented with 4-5 different words from my 100.000+ word list with more than 6 characters (no words with special characters included, just ASCII). The password input dialog would be formatted with 4-5 fields instead of the normal single field, to reenforce the passphrase paradigm. Upon registration the password can be regenerated at will, to give the user the ability to select a passphrase consisting of words that they can easily remember. The user can not enter their own words.

I know from personal experience that CreeperHost [3] already uses this method, albeit with a single password field with four concatenated English words.

My questions are as follows:

• Would this method be more secure/effective than allowing users to pick their own?


• Does anyone have any experience with implementing a similar scheme? Was it effective?

---

1. The Tangled Web of Password Reuse - http://ift.tt/1Cplw4o


2. Password reuse - http://xkcd.com/792/


3. Password Strength - http://xkcd.com/936/


4. Creeperhost - http://ift.tt/1c9ne9X