<i>&gt; Anyone with access to your email account can simply reset any password on any site. The right solution is to make your email account very, very secure.</i><p>No, the right solution is to stop using email as sole identification for password resets. Yes, there are other solutions you can implement right now without waiting for some big company to save you.<p>The most obvious one it to create a second factor of authentication <i>just for account resets</i>. It could be via an SMS <i>OR</i> simply by asking user to print out&#x2F;write down a special randomly generated &quot;reset&quot; number.<p>&quot;But SMS costs money!&quot; No, for most providers you can send an email to a special address reserved for the phone number. It will get translated to SMS automatically.<p>&quot;But users will forget&#x2F;loose their reset number!&quot; Maybe, maybe not. It&#x27;s a cultural thing. You don&#x27;t expect them to loose access to their email, but that happens all the time.