Fuck the cyber idiots and their “change password” requirements.

Static password with good 2FA is the way to go.

I ran into some app a while back that required 2fa “text you a code” to log in every time.

If you put in the wrong password, it’s still sent you the 2fa… Which it would accept for login.

I’m honestly not sure if it ever even checked the password.

I’ve seen an increase of sites that bypass passwords altogether and rely on 2fa (claude.ai was one I noticed the otherday)

That’s… not 2FA anymore. It’s reverted to 1FA, now with sprinkles on it.