I've long been of the opinion that passwords on their own aren't fit for purpose.

2FA has to be the way, surely? Most people are going to be a lot more careful with their phone than with a post-it note.