A temporary way to opt-out of some of these things might be a good thing. I am on the glass half empty side of if user passwords will improve on a scale requir

A temporary way to opt-out of some of these things might be a good thing. I am on the glass half empty side of if user passwords will improve on a scale required. Even if you get to 90% of users using a good enough password, that still seems too low. For an average user, it is difficult to use a different password AND remember it, and that barrier probably will not change much. Many users still aren't going to start using a password safe. The article mentions but dismisses multi-factor as degrading the user experience. But I think with the dominance of mobile devices, that providing a simple multi-factor token has become easier than carrying an RSA dongle. I find Google's use of the SMS token to be quite convenient.