Hacker News Reader

Nothing externally accessible should allow password login at all.

SSH key-based logins are so much more secure and convenient as heck once you invest the time to learn how they work.

For PCI you still need two factor. Its overkill, but we kept password logins even after having keys.

A smartcard is still fairly convenient and allows you to tick the two-factor box (card + pin)