I think part of his point is that memorization & post-it notes are improper ways to manage passwords. In general, a password one can memorise is too low-entrop

I think part of his point is that memorization & post-it notes are improper ways to manage passwords. In general, a password one can memorise is too low-entropy to be used — and I think we all agree that writing passwords down is just terrible. And email resets have their own failure modes. For one things, it gives your email provider access to all your email-resettable accounts.