100% agree, and also never give a login with nsec option.