People being stupid is a major issue. And once you're using a different complex password or passphrase for each site it's a major issue keeping track of them. So lazyness is an issue as well.