1) User is asked to enter his email address
2) User is immediately logged in, and a generated password is sent to his email adress
The generated password is short and pronounceable, lower case only and avoids annoying characters like l, I, 1 etc. While most security experts would consider this password extremely insecure, it is in practice much more secure than any other password the user would choose because the user can't choose the same password he usually chooses. If my server becomes compromised, there's no risk to his other online accounts.
This approach might not be sufficient for a banking site, but it's probably enough to deter occasional mischief.
As a user I would like this flow, but as the site owner I worry about people misspelling their e-mail address. They would then proceed to do things under the account, but once their login expires they could never get back.
Show them the email in nice, big, centered letters after they sign up and let them edit it. I think it was Luke Wroblewski who said this approach reduces misspellings to a ridiculously low number.
1) User is asked to enter his email address 2) User is immediately logged in, and a generated password is sent to his email adress
The generated password is short and pronounceable, lower case only and avoids annoying characters like l, I, 1 etc. While most security experts would consider this password extremely insecure, it is in practice much more secure than any other password the user would choose because the user can't choose the same password he usually chooses. If my server becomes compromised, there's no risk to his other online accounts.
This approach might not be sufficient for a banking site, but it's probably enough to deter occasional mischief.