I think the issue is a bit more fundamental: Security is an afterthought. There are no repercussions, or gain or expected real punishment for not providing a se

I think the issue is a bit more fundamental: Security is an afterthought. There are no repercussions, or gain or expected real punishment for not providing a secure solution. These hacker protection plans are just to tick off a box and satisfy a regulation (government or internal). On the other hand if we cared about security we would not rush to assign a long lasting hard to change number to a person, and share it around... (Or worse in the case of SSN (for the U.S.) pick a number that is neither randomly assigned nor equipped with a validation mechanism.)