'...average of over 100 passwords in Europe'
Not even the people I know who generate randomised passwords have more than 20 they use regularly.
Is it an exaggeration or a realistic figure?
However, I use a password manager that logs in for me, as well as generating passwords. I actually don't know what 99% of my passwords are, and almost never type them.
This Trust API sounds interesting. I'm curious to see where it goes.
If you get the password to one of my unimportant accounts, you get the password to most of them. They're unimportant, but still...
I classify my accounts as critical/financial (if someone got this it would cost money or legal problems) and don't care.
I have a handful of critical and financial passwords, but every "don't care" is the same password. If someone gets my HN password, they also pown my facebook and linkedin and random forums and sites, but those are irrelevant so I don't really care because none of that stuff matters or contains anything important. (By important I mean real world important like buy food or get medical care or whatever, in an abstract sense HN is important to me, but not nearly as important as being able to feed my kids)
I don't know what I'd do with micropayments (if someone stole this login they could steal the equivalent of a can of soda from me... should I care enough to set up and maintain and track and occasionally change a special dedicated individual password for that can of soda equiv for something like that?)
I believe this also explains the rise of Amazon. Oh man, somewaycoolstore.com won't let me check out without creating an account and keeping my credit card info (probably in plain text of course)? That sucks. I'm willing to buy the same thing from Amazon for more money because I don't have yet another account and yet another pending security breach with my CC number.
Note that some superficially "financial" sites are not risky. If someone stole my electric company login, they could... pay my bill for me? The site isn't terribly functional and I like it like that. I can only write payment methods not read payment methods, so my bank account info is perfectly safe. Their billing system thankfully isn't integrated with their customer support at all, which superficially sounds awful, but at least if someone stole my acct they couldn't enter a service disconnect order in my name. I'm pretty well off, if someone else clicked "pay bill" for me they couldn't cause bounced checks, I just have too much money for that (and/or my efficient house has bills too small to matter). I guess the worst thing someone could do to my electric company account is change my password, which would waste about 10 minutes of my time getting it reset over the phone. Its not worth the substantial operational cost of setting up a special password.
I don't need fingerprint reading and retina scanning and DNA verification to log in and click "pay" every month. A truly interesting passwordless solution would be for me to give permission to not password protect my electric bill. The "secret" data is already public and resold to every .com and .gov on the planet. A suitably intelligent protocol more complicated than "click, its done" could work. If I got push notifications of anyone including myself or wife trying to pay my bill and they didn't charge for a day or two and I could fix any "problem" in less than a day or two, I'd be happy with that.