> Many applications need a way to contact a user … password reset At this point the password is pointless, you might as well just use the email address. Or per

> Many applications need a way to contact a user … password reset At this point the password is pointless, you might as well just use the email address. Or perhaps a distinct username and email address, but then there would probably be a “forgot username” workflow making that as pointless as the separate password.