Please have a look at the "recommendations" of your national security agency (except NIST). It is all outdated, written by people who thought they understood s

Please have a look at the "recommendations" of your national security agency (except NIST). It is all outdated, written by people who thought they understood security in the 90's. The French ANSSI recommendations are ridiculous. The German as well. Having an incompetent gov org forcing you to apply their "best practices" is terrible. We have already for banks and look at what they have done: all possible "don't do it!" implementations neatly on one page (source: Boursobank, Fortuneo and other French banks who replay that the security is "reviewed by experts")