The problem with that approach is that people are very bad at remembering random strings of text, so they're likely to write this down or copy it somewhere on t

The problem with that approach is that people are very bad at remembering random strings of text, so they're likely to write this down or copy it somewhere on their computer. Depending on the attack scenarios, that may not actually be more risky than allowing users to choose their own password.. I'd say that the best compromise of these approaches would be to encourage the use of password safe programs which at least store the password list in an encrypted format on local machines (of course this still relies on the user choosing a strong password for the password safe..)