https://news.ycombinator.com/item?id=27521248
Turns out I was wrong about security. Password recovery requires a separate cloud-based account. Setting a password does not.