It&#x27;s nearly impossible to talk about security in government orgs without extreme bike shedding regarding password length, changes and  special characters.<p>It&#x27;s not only about security - we have to factor out usability to prevent yellow stickers with &quot;hard passwords&quot;.<p>2FA gives both usability and security and easy detection of dictionary attack against system - it could allow for even deliberately leaking passwords and then monitoring honeypots.