I’d almost suggest a form of passive threat analysis, on the basis that someone occupying a compromised hash is regarded as a weak link (don’t ban the hash, but

I’d almost suggest a form of passive threat analysis, on the basis that someone occupying a compromised hash is regarded as a weak link (don’t ban the hash, but notice it, and keep an eye on things surrounding it), but even that idea is bound to provoke abuse. E.G. Right now, Google keeps looking at my browser string, and starts whining and making unwarranted demands when it sees something unexpected. Oh noes! UR browser string seems goofy! Time for mandatory 2 factor auth, buddy! Fuck you, Google. Fuck you, right in your stupid fucking face. I decide my security stance. I decide what’s dangerous. I decide which risks are acceptable.