Unrelated: an observation I keep on making is that convenience and security tend to be inversely proportional. A both convenient and secure solution (e.g. passwords) is the best solution to large-scale auth because it makes devs worry less and users do less.
I wouldn't say that's unrelated but it's definitely true. I think that if more 'normal' people cared about security we would come up with a convenient and secure system already. For example, would two factor be such a big deal if everyone had an authenticator already? Probably not.
Free start up idea, everyone: super-convenient 2-factor auth.