True, but why would the organization need to store the password? Wouldn't it be simpler to just generate a random 4 words (or something similar) then treat it t

True, but why would the organization need to store the password? Wouldn't it be simpler to just generate a random 4 words (or something similar) then treat it the same as a user supplied one.