Maybe that is why so many things live in Excel instead of a proper database. Security at the expense of convenience does come at the expense of security, after all.
Not sure why passwords still exist conceptually. I was hoping we'd move past this annoyance, but instead security has become even more annoying. And all that security with two factor hoops to jump through only for someone to steal your session cookie.
What would passwords move past too? A device people lose? Some specifications everyone argues about and implements differently. Just look at SAML and everyone using slightly different terminology.
Security is more annoying because the attacks are better than ever.
Certificates seemed promising there for a while. I also don't mind hardware keys/cards, but when you have to first enter your password, then your pin for your hardware key and then touch the hardware key it gets ridiculous again.
Not a fan of biometrics, though, as that cannot be changed trivially.
Ideally, authentication should happen like entering a building. You do that _once_ at the beginning of a day by swiping your card or unlocking a door and then it is done and you are never asked to do it again for the rest of the day.
I don't have to enter a password and a pin for my key to open the door to either my office or my home. Sure, it might be trivial for an attacker to enter the building using different means, but that hasn't prompted us to play security theater around every building entrance.
>but that hasn't prompted us to play security theater around every building entrance
Um, then you're just not going into any secured buildings. There are places where you must always have a badge showing. Or, you must always be with another known member of staff keeping an eye on you. Often these places have locks on every door with access levels.
It really just sounds like you're a bit less experienced with security in this case.
Notice how none of that is a cumbersome user experience. I put a badge on my person and maybe have someone walk beside me and that's it. I notably do not have to unlock the same door over and over again by first entering a password and then entering a pin and then touching my hardware key. Again and again,.. and again.
As for personal experience, the most secure facility I entered so far was a data center. It was not annoying to get in and out of that either, despite a whole lot of security.
Not sure why passwords still exist conceptually. I was hoping we'd move past this annoyance, but instead security has become even more annoying. And all that security with two factor hoops to jump through only for someone to steal your session cookie.