[onphonenow]

Agreed totally. I had a nightmare govt double vpn situation. Very hard to get an account, you had to run ancient OS and Java (it would annoy you with warnings about lack of security/age) and comical password complexity / rotation rules. The result was rampant password sharing but also because you had this double vpn setup, each layer rotating - folks just couldn’t remember passwords. So they outsourced password reset. To reset your passwords you provided your 100% predictable username - that was it. Even I had to get a reset due to an inactivity lockout and I had to laugh at how easy it was after all the silliness - I could have given any username