Password reuse and credential stuffing
Shouldn't we just stop using email/password or username/password entirely? It's already relying on the single point of failure being the users email account, because that is where you send your password reset emails.
Just add a simple requirement to passwords: 1) user can't choose them and 2) they are single use. Now you don't need to store them in a database.If an attacker controls my email account then they basically control all my other accounts too.So how many here tend to not even try to remember passwords, and instead just always hit "forgot password" to log into a site?Why isn't that the default? I.e. why aren't all passwords single use? I just enter my email, the site generates a secret and sends it to my email account and that's it. It might sound like a hassle - but personally I think it's less of a hassle than using a password manager (I use LastPass and their browser integration is more cumbersome than a copy & paste from inbox!)