"in a system that really shouldn't be so complex" [citation needed]
Do you actually have a less complex way to reliably identify a person at the other end of a computer network?
(physical keys using NFC stuff are pretty exciting, but the tech isn't in place yet... until then we're stuck with "something you know" and the limits of human memory vs computer power)
It's good advice, but it's by no means simpler than the alternative.