> I imagine what you are proposing then is to record the entropy on the password Or just generate secure high-entropy passwords and force users to use them. M

> I imagine what you are proposing then is to record the entropy on the password Or just generate secure high-entropy passwords and force users to use them. Making users look up SMS codes before each login is acceptable. Making them solve obnoxious, long, privacy-hostile riddles is acceptable. But forcing them to use pre-generated secure passwords?! That can't possibly work. They will revolt!