Exactly this. I've made the same comment other places on here. Fingerprint for username, 8 character alphanumeric for password and mandatory hardware 2FA fobs/keys.