The article seems trivial compared to what I see as the real security risk - unrelated sites that have an "I forgot my password" option which relies on e-mail t

The article seems trivial compared to what I see as the real security risk - unrelated sites that have an "I forgot my password" option which relies on e-mail to reset the password. If an attacker has your gmail, they can go to your bank, your stock brokerage, your retirement accounts, your credit cards, etc and say "I forgot my password" and use the e-mail access to reset those. I hate that my bank wants me to put in "Your mother's maiden name" as a "security question" when that information is painfully easy to get (relative to password). I always enter fake information, but I really wish there was just an opt-out for the password reset feature.