You can also go password-less. Sessions are started with a URL sent to email. The session only begins if the cookie + signed URL match.
Requiring a webcam and signing in by recognising interpretive dance would be a less crap idea.
The usual "argument" about email resets is irrelevant - a password reset (a) doesn't have to be fully automated, (b) doesn't grant invisible access to an attacker (c) should leave an obvious audit trail