The users have to pay for the inability of service providers to
  provide security. The whole system is flawed of course:
  Everything is password based in the end. It's a deep error that
  I don't see being fixed anytime soon because it's been with the
  systems from the start.