The industry has been trending towards OTP, FIDO, WebAuthn, and all sorts of identity solutions, instead for years now. In that sense, they don't improve security overall, and introduce many other issues (a centralized honeypot, in the case of services like LastPass). Password managers are a solution to somewhat sanely and securely manage this complexity, and not something that the average user wants to think about. Passwords and login credentials are dead. :) And as mentioned, already exists in many forms. No offense, but this is such a hacker solution. This is a supplier that was named 'Leader' by Forrester and got a $30M funding round last year. So who knows what their SaaS offering was leaking from these containers? I mentioned this to both internal IT architects and the supplier and nobody really seemed to care. This was when I realized that our supplier didn't roll their own containers, but just used off the shelf stuff they didn't even audit. 'Luckily', our on-prem box didn't have an internet connection, because of the sensitivity of our data. In one of them, I noticed an error because something in the container was trying to phone home with telemetry, to a server that wasn't owned by our supplier. So I used docker to get command line in the containers and see if I can find some logs there to then get into a log store. There was no option for this (then how did they monitor their SaaS?). While running the application, I was missing a lot of context, since logging was minimal, so I asked the company how to connect a log store to get an overview of all the sub-systems. We pretty much got a copy of the stack of containers and docker-compose file that they used to run their SaaS offering. The product was SaaS by default, but they offered an on-prem version. It was purchased through a tender, where on-prem was a requirement. I Worked with a government organization where I was part of the team on-boarding a new on-prem system. Well, even with private cloud and on-prem these are pretty relevant questions. Ask them to show you the audits they've performed on THEIR supply chain this year. Ask them which open-source libraries their SaaS uses.

Last pass data breach