Basically every local service is accessed via a web interface, and every interface wants a username and password. Assuming none of these services are exposed to the internet, how much effort do you put into security here?
Personally, I didn’t really think about it when I started. I make a half-assed effort at security where I don’t use “admin” or anything obvious as the username, and I use a decent-but-not-industrial password - but I started reusing the u/p as the number of services I’m running grew. I have my browsers remember the u/ps.
Should one go farther than this? And if so, what’s the threat model? Is there an easier way?
All my local services follow the same rules as any other service. I have no idea what the passwords are, they are all random and long as fuck in my password manager. 2FA with a hardware key where allowed, TOTP if not.
What possible reason would anyone have to “relax” or security on local services? That would mean having 2 streamlines which only adds friction.
I strongly suggest you move all your credentials out of your browsers and into a password manager.