And if you gave the option to users of being able to retrieve their old password or have a new one generated, most would choose the former. And if you explained the drawbacks and advantages of each approach and made the user make an informed decision, most users would just click the Back button.
No, i don't have any evidence, other than anecdotal. It's what I would prefer, because changing the password from random to something that I might remember is an extra step, and an unnecessary one unless security really matters (e.g. money is involved). I took it as given that people prefer less work over more work.
