Additionally, two stage password protection if you are using gmail or any other service that allows it makes breaking into an account nearly impossible even with a relatively weak password. Also, I am curious how many bits of entropy do you allow per tier; losing control of your main email account is a lot worse than most people seem to assume- The accounts I have seen which have had regular use often include a SIN and a fairly large amount of information which can be used for much more costly or malicious attacks than online banking provides. I used a two tiered system at and 60 and 75 bits respectively, and if you actually want something to stay secure for any length of time against a GPU assisted brute force attack then you basically cannot go under 56 bits, which still only buys you a month against a good system.