There's tons of debate on this. New California law suggests that a weakly stored combination of Username and Password is considered insecure.

The counter argument runs that if username was insecure, most email systems would be affected. For example, Google uses your email address (which is obviously public) as your username to connect to all their apps.

I like the idea of using 2-factor authentication for higher security, but average users will find it to be an annoyance. It's a balancing act.