Ah yes, the classic problems: * log in/out take an unreasonable amount of time * password rotation despite that being demonstrably worse for security across e

Ah yes, the classic problems: * log in/out take an unreasonable amount of time * password rotation despite that being demonstrably worse for security across every metric Followed up with some domain specifics: * Failing to acknowledge a single system or device may be shared rapidly among many different users * Delaying access due to excessive authentication steps can kill people * Not understanding that a "quick action" is not quick if it requires another action that is not quick (surgery prep is not a 5 second task people) The first set are inexcusable in any environment, especially password rotation, the latter just requires the people coming up with security policies to actually spend time in the environment their policies will apply.