Except that users are really bad at choosing strong passwords. A significant percentage will even use the same email&#x2F;password combination accross multiple sites.  For a site which contains sensitive financial or medical data, it is better to issue a &#x27;username&#x27; that contains random characters. (This is the technique the UK government uses when users log in to pay tax)