To be honest I think this is a problem that needs to be solved outside of the web. We need to move towards password managers. Of course, that comes with its ow

To be honest I think this is a problem that needs to be solved outside of the web. We need to move towards password managers. Of course, that comes with its own set of issues: Lose access to the password manager = lose access to all your accounts. An attacker gets access to your password manager = they get access to all your accounts. On the other hand, for users who use a single 6 character word as their password all over the web, that's essentially the same thing. You can far more easily educate someone in picking a very strong passphrase they will never forget, than get them to use different passwords on each website. I have successfully converted several non-techies in my family to KeepassX [https://www.keepassx.org/ https://www.keepassx.org/], which I also strongly recommend to anyone here. I had to hold hands at first but after explaining how it works and making sure they understand how important it is, over two years, there's never been any issues.