I think this points to the inherent weaknesses in the concept of "username/password". Why do we still have this paradigm? It worked in the 80s, but I think there needs to be a new paradigm in place today. Ideally you'd want a system like public key authentication, with some bio-marker used for identity management.