True but it would be interesting to see some data on how many over the phone password resets big service providers do on a day to day basis. That kind of data would at least be a litmus to invalidate the current paradigm.