> The second component of this, for people that doesn’t care to do good track of their passwords, is that their email passwords are usually memorable in the wro

> The second component of this, for people that doesn’t care to do good track of their passwords, is that their email passwords are usually memorable in the wrong way. So both your mail and all the dependent services are all held together with the same weak clip. The point is that they are already tied together because most sites allow password reset (or account recovery) via email. It doesn't matter how securely your sign-on is designed, what identification token you are using (username, biometrics), what authentication mechanism is in place (passwords, MFA, yubikey, etc) if all an attacker has to do is type in the targets email and click 'forgot password'. If your site allows password resets or account recovery via email, then the users account is still only as secure as their email password anyway. Adding yubikeys, MFA, authenticator apps, etc into the mix doesn't move the security needle a single bit at all.