First, it's ssl only. Second, the alternative (which I'm trying to avoid and where this idea came from) is a user being prompted for a password and responding s

First, it's ssl only. Second, the alternative (which I'm trying to avoid and where this idea came from) is a user being prompted for a password and responding something like "er, um... Password123" or just using the same password they use for everything else The idea was that this may give users a bit more time to think about passwords, and possibly be more secure than the usual passwords. Stating the idea here is giving me some good things to consider