&gt; As security people like to say, “put all your eggs in one basket and stick the basket in Fort Knox”<p>I&#x27;m not so sure I want to do that. The point is, even that single Fort Knox can be breached at some point, and if it is, then everything is lost.<p>I agree that nowadays, email is almost unanimously the way to verify a password reset, and hence all your eggs are already in one basket, but shouldn&#x27;t there be further protections?