Expecting average users to use unique sufficiently complex passwords, or even just a few "tiers" of passwords, will never work because users just don't care...

Expecting average users to use unique sufficiently complex passwords, or even just a few "tiers" of passwords, will never work because users just don't care... until it's too late. Single sign-on systems are the only reasonable solution. Of course that introduces a single point of failure, so they need to be extremely secure, but at least it's easier to secure one system with two factor authentication, advanced monitoring, etc than every site on the web.