Interesting. So we have a clear-cut case of having to choose between (a) more security; or (b) a simpler sign-up process which means more revenue.

It seems to me that choice (a) will not always be the right one - it depends on how much security would improve and how much revenue will be lost. If you find the previous HN article on this topic that you mentioned I'd be curious to read it.