You aren't being negative, that you very much for the thoughts 1. Good password requirements doesn't mean that your users will use secure passwords. Password12

You aren't being negative, that you very much for the thoughts 1. Good password requirements doesn't mean that your users will use secure passwords. Password123! is not secure. There is nothing wrong with 2 factor authentication. This is not a replacement for that. A lot of users choose not to use 2 factor authentication because they don't want to go through the hassle. So we have a strong password policy and we have 2 factor authentication enabled, yet our user isn't using 2 factor authentication and their password is extremely weak. 2. Yes the Blur infrastructure adds an extra component to your application to it and if something were to happen to it, availability would be in jeopardy. Resources would need to be put in place to reduce that risk, just like a database. 3. This can be a self hosted internal application. Its does not have to be an external service. What i have on my website is a demo. How an organization chooses to deploy it is up to them and i agree it makes the most sense to deploy it internally. 4. I don't understand how a SSO would make this solution less relevant. If anything I would think it would make it more relevant. To have a host of applications use one entry point for authentication, its more important for you users to use secure passwords. If the SSO account was compromised, all apps using that SSO is now at risk. SSO in my opinion isn't a security solution, its an integration solution. I don't see how Blur would cause stakeholders and developers to become less complacent regarding security. I'm sorry but that doesn't make sense to me. Blur does not log any of the passwords it secures. No information regarding the original password and the secured password are logged or stored in any database. Again thank you very much for the concerns.