Personally I think all web services should be using aliases (so you don't login with the username that other people see) and pass phrases rather than passwords.