thats part of why NIST updated their password rotation recommendations from 90 days to indefinite: people pay lip service to security if it is too inconvenient. you have to try to meet people where they are.

Preaching is not a strong motivator for long.

The level of lockdown in current years is wild. With our 2FA requirements and SSO, signing into GitHub every morning takes me something like eight clicks and a solid minute. Everything has gotten so locked down in recent years, people are working so hard to protect what are largely basic CRUD apps

That’s fine as long as you are kept logged in or at least have an abbreviated login process after successfully authenticating in the morning.

CRUD apps can contain very sensitive data, so not sure how that’s relevant.

I think security became part of compliance so security recommendations got detached from actual security. It seems like a lot of security recommendations are just busy work that justifies having a huge compliance industry. So an example of this might be security scanners for code where the output is not even useful. But using the tool, which searches for irrelevant findings, is required for compliance even if it basically does nothing for security.

Just get off as many of these platform as you can. That’s about the only security that you’ll ever get. If you are still in the Matrix, listen the weirdos on here that take “don’t trust anything” seriously to the point of absurdity.

The Matrix was not fiction. Our modern internet is a system. You have to figure out how to live truly free from it, because it absolutely owns you.

__

Revelation 13:16–17

“And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads:
And that no man might buy or sell, save he that had the mark…”