I think OpenID + owning your own domain is a good solution to this problem. You simply put some special HTML in the header of http://<yourdomain&#62 http://<yo

I think OpenID + owning your own domain is a good solution to this problem. You simply put some special HTML in the header of http://<yourdomain&#62 http://<yourdomain> to create a "delegate" that points to an authenticator of your choice. If this authenticator goes down or is compromised, then you edit that HTML stub to point somewhere else. I prefer using my domain name as a single point of failure over my email address, because I think it's harder to lose control of my domain name (actually if I lose my domain then I've lost my email too, as that controls my MX record). The problems are that not every site supports OpenID, and that owning/maintaining one's own domain isn't as easy as getting an email address (tough for grandmas to do). The former issue would solve itself if OpenID would become more used (kind of a paradox), while the latter is slowly gaining traction, I think (now with sites like GoDaddy it's not too hard for lay people to buy a domain and write HTML with a WYSIWYG editor). Remember, there was a time when getting an email address was not a trivial thing.