This article touches on something I've been ruminating about the past few months - the lack of control users have over their own security posture.

Like many people, I use dozens of online applications a day, from banking through to childcare booking platforms to online shopping. With data breaches becoming ubiquitous and a common occurrence, providers are under pressure to secure their platforms.

This means they're all attempting to implement "best practice", with various degrees of maturity and efficacy.

The consequence of this is a huge degree of friction on a daily basis. Myriad authentication apps and schemes. Some using TOTP. Some using SMS 2FA. Some using push notifications through their own app. Some using magic links via email. Some with passwords, some without. Maintaining all these has become a significant administrative burden.

But the enforcement, and inability to opt out, means I have limited say in choosing NY security posture for each service. Some accounts I have are throwaways that I couldn't care less if they were compromised. Even with strong and secure passwords, I still need 2FA. Worse, those that I do want a strong security posture with often have a backup recovery scheme, such as magic links via SMS, that I deem inherently insecure. Yet I am expected to trust that the platform provider knows what is best for me.

As mentioned in the article, losing access to platforms has been a bigger issue for me than account compromise. For example, I had an old Twitter account I wanted to access once X took over. Although I had the password, they had implemented 2FA since the last time I logged in. Since In didn't have a current email on file with them, I couldn't receive the verification link and have now permanently lost access to that account. Providing that I had the (strong) password, that I was using the same static IP address I originally signed up with, and providing government identification was insufficient to regain control.

I'm a fan of passkeys. I now also use a Yubikey. But simple passwords still have their place and can be useful and secure I'd handled well on both sides.