And the official auth URLs are always such random crap that I'm surprised people don't get phished left right and centre.

No owners, no responsability, no incentive to fix it. Ticket grabbers and checklist markers.