I agree with what you have said but I think the new guidelines don't go far enough. The biggest problem is that in the balance of security and convenience, user

I agree with what you have said but I think the new guidelines don't go far enough. The biggest problem is that in the balance of security and convenience, users will always opt for convenience. Only via legislation will that change, think credit card chips versus swiping. (We should have chip + PIN in my opinion.) We need to make passwords a much simpler thing to manage so that people don't create a bigger problem by putting it on post-its on their monitor. What I'm suggesting would take some effort but is where we need to go. Your username is your fingerprint. You won't forget that and it is very hard to fake/brute force. (Your phone already has one and a usb one for you computer would be trivial. A lot already have them.) Your password is always just 8 characters, alpha numeric only (62^8 is plenty big) and you must have 2FA on. It would be trivial for the phone manufacturer to add that at the OS level and it could be visible on your lock screen. Also, finally a good use for a smart watch. The rules are simple and you have removed the biggest security hole most companies have: people. Just my two cents....