The right responsible thing for website and application developers/owners to do is NOT allow users to create their own passwords. Generate one for them.
But that doesn't mean the passwords have to be hard to remember. Four randomly chosen 3-5 character words from the standard 25k word dictionary on Solaris is identical in strength to an 8 character purely random password that that uses all possible keyboard characters (26 lower case, 26 uppper case, 10 numbers, 12 special characters). Three of those is identical in strength to a 6 character password, which is certainly far more secure than 95% of the stuff I see people using, even "professionals".
ex: fuse larva elite scare
Question -- why doesn't Firefox or Windows or Linux come with a little application that GENERATES a secure password for the user? Why do people who make operating systems and Browsers expect USERS to generate passwords themselves, and then you wonder why they are so insecure?
In my professional opinion -- the professionals are to blame.
*** WHERE is an average user supposed to get a properly generated secure password? ***
Linux has a perfectly good random number generator based on proper entropy collection, does Windows? Unfortunately, neither is usable as is by an end user. Don't point me to some idiot website run by who knows who. Unless someone big like google or yahoo have an SSL page that I know I can trust to have done it right and/or not be tracking IPs and passwords for latter exposure.
(Disclaimer - I am a professional, and in the small company that I work at, I've been slowly eliminating all of the "luser generated" passwords for quite some time now, and forcing them to use ones that have been properly generated.)
The second thing to do would be to get things like OpenID working and make users aware of them, do things to encourage them to use it. Unfortunately I tried to use OpenID myself (as a user) a year ago -- and I was *really* unhappy with how hard it was. There's no way in hell I can recommend friends and family to use it. There's huge usability problems with it impo. It requires way way too much expertise and willingness to screw around.
We need something conceptually simple to USE, but that still doesn't present a single target that would result in all of the end user's accounts being violated if a single site is penetrated. This is an excercise left to the reader. :)