When user password are used for security, proper services have additional questions (in other words 2FA) to reset your password by email.
Re:Cierge – passwordless authentication
by WorldMaker on Friday January 12, 2018 @12:07PM
(#16134360)
Additional questions are bonus passwords. They are not 2FA.
The Cierge login approach would obviously be inadvisable for protecting something of importance, like your email account.