That is an interesting dilemma. As we grow and the average end-user goes from 1 to 5 to 10-20 sites that is being protected by Rownd, we will enforce greater and greater authentication schemes for Rownd.

The truth is, if your email is compromised right now, most sites will be compromised since "lost password" fall backs are sent over email. 2FA is the way to go into the future.

The heart of this issue is around how to authenticate users quickly and securely.