Challenging password dogma

This blog post critiques traditional password guidance—such as enforced complexity and frequent rotation—as counterproductive, and instead promotes unique passwords, MFA, and password managers, aligning with the "three random words" approach. It offers concise user and IT policy recommendations to strengthen authentication security pragmatically, reduce user friction, and phase out insecure practices (e.g., SMS-based MFA, browser-stored passwords), emphasizing defense over dogma.