Regular reminder that new users in general don't care at all about the security of your site. Most of your signups are not going to generate and store a secure password "just to try you out", as evidenced by the most common password here "123456". If you force people to signup to try your site/app, many (most?) of them are going to use a crap password. If you're _lucky_ that'll be 123456, and not their email/facebook…
The security model based on passwords kept by site provider is totally broken. I, as a user, don't want to keep 20 different passwords for 20 different sites. What I want, is host my own security agent through which I can talk with any site. If I want to authenticate with site x, I simply point it to my security agent url and that's that. Open ID was/is an idea. This approach will drastically lower the incentive for…
Decentralized schemes are safer overall. Ideally you want something like what LastPass does: local credentials replicated on the network in encrypted form. This way you take away responsibility for safe storage from unreliable websites, but you don't place the whole burden on the user (as the data is replicated and locked by a single password).
