Good point, I had missed the impact of email as an authentication tool. I think the industry should move towards a decoupling of that from email (or worse, social networks). I think there's been some movement towards using phone numbers instead, but that presents its own kind of issues.