I'm not sure it improves security significantly, but the weak link is using passwords as security in an environment like a university. Getting users to confirm

I'm not sure it improves security significantly, but the weak link is using passwords as security in an environment like a university. Getting users to confirm to good password practices is nearly impossible when they are mature, paid employees with money and valuable IP on the line, and at organizations with legal/regulatory security requirements. Imagine accomplishing that with thousands of college students. (I'm not sure there's a good, cost-effective solution, other than to provide more secure options to users who want them.)