The best measure? Ditch the password. It can be reset anyway, it can be stolen, it's just unnecessary complexity, it doesn't provide any security. You can prov

The best measure? Ditch the password. It can be reset anyway, it can be stolen, it's just unnecessary complexity, it doesn't provide any security. You can prove ownership of the email? You can log in - worst case, after a password reset. So why have a password? email: ______________ [Log in] The "Log in" button results in a "Check your inbox and click the link in the email that we just sent you" page. Source: https://appear.in/ https://appear.in/ used this flow from the very beginning, before it was destroyed in a trademark dispute. EDIT: now it is https://whereby.com/user/login https://whereby.com/user/login