In my case none or both, depending on the need. The point is, you could allow lower security if people need it and it's not necessarily that catastrophic as the author suggests.