> - Security questions. Yeah, right, please give us what amounts to a password, but that other people likely know, and that we'll probably store in plaintext. Y

> - Security questions. Yeah, right, please give us what amounts to a password, but that other people likely know, and that we'll probably store in plaintext. You'll use this much weaker backup password if you forget your real one. A good password manager, such as KeePass, will generate a passphrase. That is, words. Use that instead. Even if they ask "what is your mother's maiden name" just make up a passphrase. > - A time component. Any kind of it. Sessions should not have an expiration time, period. Not unless I specifically checked a box that I want a session that expires. I never, ever want to be greeted with a login form when I follow some link when I've already logged into this thing a hundred times in this browser. Yes, but; > This may have made sense 15 years ago when people shared computers, but people aren't sharing computers any more. This is false. I know many people who share computers. I treat all my computers as shared even though they are not; it's safer that way. > - Related: required password changes once a certain time period. Bonus points if I can't reuse any password I had in the past. You want me to forget my password? Because this is how you make me forget my password. I agree that password changes after a certain time period is stupid. However, a password manager solves the problem of forgetting your password. > - Doing anything with IP addresses besides packet routing. Yes, my ISP uses a single IP address for at least several tens of subscribers. No, it's not my fault and I should not be punished for this. And no, if I went to other country, this doesn't mean I'm dangerous to the security my own accounts, ffs. You shouldn't care. You were provided with correct credentials, and you thus must log me in with no hindrance. 100% this