Personally, I like when people have usernames, and have to enter those, to receive a recovery message sent to the associated email. Or better yet, enter both u

Personally, I like when people have usernames, and have to enter those, to receive a recovery message sent to the associated email. Or better yet, enter both username and email together. Because it's more likely the attacker won't know both. In any event, I have been recommending to everyone for years to use email aliases (that GMail and others support) as your login. Have a different one for each site, for example yourname+az@gmail.com for amazon. That way, you can avoid crap like this which is out of your control, since the attacker won't even be able to repeat your login email: https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking...