Password reuse and credential stuffing
Shouldn't we just stop using email/password or username/password entirely? It's already relying on the single point of failure being the users email account, because that is where you send your password reset emails.
Just add a simple requirement to passwords: 1) user can't choose them and 2) they are single use. Now you don't need to store them in a database.<p>If an attacker controls my email account then they basically control all my other accounts too.<p>So how many here tend to not even try to remember passwords, and instead just always hit "forgot password" to log into a site?<p>Why isn't that the default? I.e. why aren't <i>all</i> passwords single use? I just enter my email, the site generates a secret and sends it to my email account and that's it. It might sound like a hassle - but personally I think it's <i>less of a hassle than using a password manager</i> (I use LastPass and their browser integration is more cumbersome than a copy & paste from inbox!)