For the average user, with poor password hygiene, I'd advise them to use a federated identity option that is more likely to have a decent password - they are mo

For the average user, with poor password hygiene, I'd advise them to use a federated identity option that is more likely to have a decent password - they are more likely to have a good password for an account they care about. I think the conclusion of the article is flawed. I think the risk of getting locked out is far lower than the odds of any single, or even all of, other (non-major tech co) website you might join getting breached. It's fair to argue the impact might be less also - and I'm happy to have this debate. In my experience, typical users aren't the ones that get their google accounts banned - they are always banned for doing something significantly more sophisticated.