<i>If we assume every user is employing long, random, unique passwords</i> ... then we surrender the ability to reason about the real world. Economists are fond of that kind of thing, but in IT security it&#x27;s not terribly helpful.<p>Many (most?) users employ the same password on many different sites. So now an attacker has email&#x2F;password pairs that work not just on the site that was compromised, but also on Gmail, Facebook, Twitter, Amazon, banking sites, and so on.