[baroffoos]

At some point we have to admit that passwords have not worked and the general public does not understand how to use them despite decades of education attempts. This problem would be entirely solved if they enforced the use of 2fa

[ehsankia]

At the very least, have e-mail 2fa for new devices, it's fairly trivial, isn't too annoying, and works decently enough. Most banks and important services do this. Whenever you login for the first time on a new device or far away IP, it sends you an email to authorize the new device. It's pretty trivial but goes a long way.