>Email accounts have become, over the years, not only large repositories of highly sensitive and private data, but also single points of failure for digital foo

>Email accounts have become, over the years, not only large repositories of highly sensitive and private data, but also single points of failure for digital footprints on the Internet. This is really the key issue here. Passwords are fine if you give people some place to keep them. >...it became widely acknowledged that passwords should be highly complex in order to maximize their entropy and, thus, substantially increase the amount of time it would take to crack them. This is only true if people reuse the same password for different sites. Otherwise the site can rate limit brute force attacks to the extent that even completely trivial passwords are OK. I dunno, it seems that in most cases second factor auth is not really needed. We need to address the actual problem, not attempt to paper it over by dumping stuff on top. The "let's just let the phone company do the identity stuff" approach is a good example of failing to deal.