We need a security standard that disallows using email as ID.