Crazy terrible security practice I've noticed recently: people logging into accounts on hardware they don't own.

I rented a car and realized a previous renter had linked their Google account to it and I could see previous Maps trips and saved addresses.

I rented a house and realized a previous renter had logged into their streaming accounts on the TV and if I had wanted, could really screw with them.