Got it, I’m aware password auth can be brute forced, sadly many services don’t support more advanced auth methods so I’ve got a couple homelab apps that can only do password auth. I’m using very strong passwords and 2FA where available, and have been looking into an SSO solution like Authentik, but again not all services are supported.
Mind expanding on tip #2?