And if someone hasn’t logged in for 6 months, their account should probably deactivated anyway. But, yeah, the comment above is right about enterprise IT. I’ve

And if someone hasn’t logged in for 6 months, their account should probably deactivated anyway. But, yeah, the comment above is right about enterprise IT. I’ve sat in on meetings where 2FA was ruled out as being too unusable by the marketing team, who said quarterly password rotations were a “good compromise”. They just want to be seen to be doing something about security, and pick fixes that don’t involve much cost to anybody, but also tend to provide little value.