|
Is it just me or do you also get locked out of your accounts nowadays? This almost never happened before, but I more and more often end up in 'authentication hell'. 👿
At the dawn of time there was nothing but passwords. They were sniffed/brute-forced/phished, etc.
Then came multi-factor authentication (MFA). A password manager with an authenticator app as second factor made life livable - at least for us, security geeks.
Logging in is an 'adventure' nowadays. 🤠 You never know what to expect:
-
Weird password restrictions (min 12 chars, but not more than 16; have at least a special character but not ' or "; must use numbers but not consecutive ones, their sum cannot be prime)
-
MFA, of course
-
In addition to passwords, we now have passkeys/PINs (sometimes numeric, sometimes not) which you have to set device-by-device; some apps use the device's own passkey but some have their own and must be different
-
Sometimes there is no password, enter a one-time code via SMS. Or e-mail.
-
Sometimes you must use their app
-
Sometimes the app randomly decides to take a photo of you. Or a video where you say 'cucumber'. Of course it does not recognize you.
-
Fingerprint? Signature?
-
Stupid security questions (first pet's name), sometimes mandatory for logging in
-
For some actions you must use an Apple device. Or Google device.
-
If you enabled parental controls, this all doubles: one for the kid, one for the parent
-
Sometimes you get redirected to a social media account which just decided that you must add your phone number and change your password (see above) to proceed
-
Sometimes more than one of the above are used, but always in a different order, especially in case of Microsoft
I understand the reasons for all this. A real human being just cannot manage passwords which are secure today, and bad guys have figured out how to trick MFA users.
-
'Non-Phishable' authentication - use local-only credential, so if a bad guy steals it, it is of no use --> but having to manage device-specific or app-specific passwords and forfeit SSO? come on!
-
Risk-based - Paying your phone bill like you do every month should be simple! Logging in in the middle of the night from an IP in Latveria and trasferring all your savings? - scrutinize!
-
Identity-providers - While this should simplify things, it results in redirects (which may break), ending up at another company/organization not related to the service you want to use.
We preach of educating users, but we are training them to follow any random, intrusive security process. You can no longer write a guide, or cannot explain a grandma how to log in as it will be different next time. Just follow instructions.
I get it, there are reasons and the landscape is evolving and the dust will settle.
Security folks, I understand the good intentions, but this user experience is getting unacceptable.
This post was first published on Linkedin here on 2026-07-11.