What I don't get is we are getting NEW password rotation requirements on existing systems as part of the cyber protection pushes. We are way down the stack of

What I don't get is we are getting NEW password rotation requirements on existing systems as part of the cyber protection pushes. We are way down the stack of course but just a basic approach like 1) Allow for cut and paste passwords 2) Reduce rotation requirements (even annually would be better). 3) 2FA if logging in from a new device (with no SMS) Would I'm sure get tons of protection without the insanity we have now. Some folks are asking for 16 character passwords but allow reset with a text message or email? Or a phone call to an overwhelmed help desk who barely verifies anything. That said, I've seen worse. I once tried to go as high as I could on the chain to get something even worse fixed (we were required to hand out a form for a program that had been out of existence for 5 years so form did nothing). They would not budge, I even got legal in on it. Because someone somewhere had ordered the form be distributed, the order had not been revoked, we still had to hand it out even though everyone agreed the form and program were no longer in existence. After I kept on escalating they threatened to prosecute or violate contract if form was not distributed an I kept pursuing the issue. So thousands of people filled out a form that just went no where.