As engineers, it often feels like enforcing one policy regardless of the actor is the best solution, but I think it breaks down in practice. For example, imagi

As engineers, it often feels like enforcing one policy regardless of the actor is the best solution, but I think it breaks down in practice. For example, imagine if your email password was given out to two individuals - one is your significant other, and the other is a random dude on the internet. In theory, good password hygiene should be maintained no matter who the individual is. In practice I would be (and should be) vastly more worried about this random dude than my partner. Trying to figure out a generalized solution for big tech may prove to be too hard, and is frankly a waste of time when there's a credible geopolitical threat on our doorstep.