My current thinking was "this one is your username, this one is your password" And I have a primitive key teleport which is very nice UX for signing in across different apps and eliminates copy and paste, but is not really ideal for non trusted apps.