On: Facebook Rival ConnectU.com's SQL injection vulnerability: a story of pathetic hubris

[run4yourlives]

>And if you gave the option to users of being able to retrieve their old password or have a new one generated, most would choose the former

Do you have any evidence at all to support that?

[asdflkj → run4yourlives]

No, i don't have any evidence, other than anecdotal. It's what I would prefer, because changing the password from random to something that I might remember is an extra step, and an unnecessary one unless security really matters (e.g. money is involved). I took it as given that people prefer less work over more work.