> Yeah but no user is ever going to be able to remember either of those passwords, No, of course not. User-memorable passwords should only be used on devices

> Yeah but no user is ever going to be able to remember either of those passwords, No, of course not. User-memorable passwords should only be used on devices physically controlled by the user or someone the user trusts; high-security passwords must be used on any device outside of the user's control. It's okay to use the user's password to locally encrypt a secure key used to encrypt remote data.