One other thing to keep in mind, a lot of the time users (including me) couldn't give a fuck about the security of your website/webapp/mobileapp. If you force

One other thing to keep in mind, a lot of the time users (including me) couldn't give a fuck about the security of your website/webapp/mobileapp. If you force me to register an account to do what I need to do, and I'm never planning on returning anyway - you'll get my "default shit site password" and if you demand a deliverable email with confirmation, you'll get a throwaway-able email. I have a "spare" gmail account which I'll use with the "plus addressing" thing, so you'll likely get random-looking-string+sitename@gmail.com and the equivalent of Password123! - and I don't use that email for anything else. I'll filter mail with that +sitename to spam if/when it starts getting spam, since spammers know that trick and remove it - eventually I just throw away that gmail account and start a new one. Occasionally that bites me in the ass. Back when this stupid new "text messaging on the web" site started, you know, the one with the best and the fail whale, I was curious and set up an account (at least as much to squat my username as anything else). A few years later and I'm actually using and socialising there, late one night my account starts sending açai berry spam. Because my shit password was shit. (Luckly, they just send a half a dozen spam tweets, and didn't p0wn the account by changing the password/email on me...) One nice thing about password managers, at least you can search and find all the services you used a shitpassword on, and do an audit of whether you care enough to upgrade the password or delete that service's account.