Users reuse secrets because humans are human
Password rules that punish users often create predictable workarounds. The better strategy is layered: password managers, multifactor authentication, rate limits, breach checks, and recovery flows that are not easier to attack than login.
The useful signal is usually already there.
Security gets real when the trust boundaries light up. Poke it and see what has to hold.
Protect the recovery path
Account recovery deserves the same design attention as login. If support can bypass every control with a weak process, attackers will aim there.
Authentication policy is more than a regex.
Throttle guesses and watch anomalies
Rate limits, lockouts, device signals, and alerts make credential attacks noisier and less profitable.
Flip the switches and watch the story turn into a tiny operating model.
Identity needs layers
Passwords can be part of the story. They should not be the whole story.