I just spent an hour on my own accounts on systems I control trying to navigate the web of trust to log in. It’s a whole maze of popups on devices, emails that arrive with links, etc. because these days TOTP MFA is no longer seen as “secure enough.”
You’re hunting for the window or the device where the request went and if you take too long, it times out and the whole flow fails. At other steps, you’re waiting for emails to arrive, which puts you at the mercy of the vagaries of forwarding latency, spam classifying compute, and god knows what else and you can similarly easily time out.
You time out a twenty-step workflow and you have to start the whole thing over again. If a prompt went to a device that you had to hunt for, or the email isn’t coming through fast enough and you decide use a different address, you increment suspicion counters, or attempt counters, and before you know it you’re in cooldown, or even in brute force ban (which most platforms now put at three successive failures it seems).
Basically logging in is now taking your digital life into your hands and even when it works it can take you 20-40 minutes to log into a system and when it doesn’t work you can find yourself locked out for a day or a week or even having to open up a support ticket on a public chatbot with no concept of identity.
Meanwhile, breaches occur at higher rates than ever and continue to accelerate.
It almost seems like one is not correlated to the other.
Beyond TOTP MFA, I don’t think we can improve security further by just mercilessly beating users up with a cane. This is how we end up with the current state of affairs in which the entire lower income half of your social network on Facebook each have 40 Facebook accounts called “Mylie Smith” and “Mylie XXSmith” and “Mylie New” and “MylieSmith NewOne” and “Mylie Red” and “Mred Smith”.
Or how we end up having contacts apps full of people who each have 10 gmail addresses and you can never remember which one is currently “the new one that works.”
I’m a full stack dev and I work in cyversecurity and I’ve been in the tech industry and on the internet since before www was even a twinkle in Berners-Lee’s eye, yet logging into a lot of the accounts I manage still feels like a fraught ordeal that I fail at regularly.
This basically means that for average folk, most accounts are now approaching “single use” or “disposable” in nature.
Something’s gotta give.