False dichotomy. A single user account being compromised because they exposed the password is not "hacked." Don't let users use weak passwords and have brute-fo

False dichotomy. A single user account being compromised because they exposed the password is not "hacked." Don't let users use weak passwords and have brute-force protection. I'm curious, but did Slack lock accounts out after X failed authentications? They didn't even reveal how they were compromised. Warn users about the dangers of using simple passwords or sharing passwords between services. Make 2FA the default but let users who aren't idiots opt-out.