@Ted Clayton

Firstly, LaunchKey is not our tool and we have no connection whatsoever to the company that developed this or any other similar type of password less login tool.

the key-lock, like the login, works as intended. Both are quite effective, simple and familiar. The suggested response being promoted here, is to replace the part of the system that is not broken; that is functioning correctly & as-designed.

Simple and familiar doesnt mean they cant be improved on as can be seen by the large number of adopters of two factor authentication to add security to password based systems. These are and will continue to become more common and it wont be long before this type of additional security becomes mandatory rather than optional on certain sites. To use your analogy, key-lock system obviously dont work by themselves as almost no car uses a standard old fashioned key - electronic keys backed up by immobilisers are widespread.

The big brute-force bot-net going around these days, glancing for the keys in the ignition .... it focuses on advanced, powerful, professional accounts. It hunts for the accounts of those who really & truly should know better.

That simply isnt true - almost all recent bot-net attacks go after any website using the targeted software. We have seen this across numerous WP sites but there are plenty of other reputable large studies showing this.

The recent DNS issues with certain selected domains such as Twitter and the New York Times were completely different and in fact that experience completely supports the argument that the username / password system isnt robust.

Melbourne IT, who were the domain name registrar through whom access was achieved, said that one of their reseller's log-in credentials had been obtained, and that with them, the SEA could enter through the "front door" and carry out the attack.

"If you've got a valid user name and password," chief executive Theo Hnarakis told ABC (Australia), "the assumption from our systems is that you are the authorised owner and user of that domain name."

Of course continuing to use "admin" or any of a number of other common usernames is stupid and even without it being forced on users any longer by WP, it doesnt stop people from using them and whatever prompts are shown to people will not stop this. Another big problem is that very few people use completely randomised strong passwords made up of upper and lower case letters, numbers and special characters and yet we all still believe nobody can ever guess the password. This is mainly down to the large number of websites that people need to login to now - it is physically impossible to remember completely different usernames and passwords for every single site.

This is where systems like LaunchKey, Clef and others really come into their own. For LaunchKey, you only need to remember one username across any website that uses that same system and no password. Access is then protected by a variety of multi factor authentications.

If you want to carry on using usernames and passwords, then of course you are free to do so, that is the benefit of the WP plugin system !