Too Much Security

from here and here

Verification requires I enter the number for my non-existent cell phone? Whoops, there goes another account.

Verification requires me to retrieve a code from a recovery email that no longer exists? Whoops, there goes another account. 

Verification requires me to enter a phone number and country but the country is stuck on Afghanistan? Whoops, there goes another account. 

Verification requires a voice number that hasn't already been used to verify a different account? Whoops, there goes another account.

I should be able to decide whether or not extra security mechanisms are required for my accounts.

Security for the Horde

from here

WoW has had 2 factor authentication since 2008 (if not earlier). They used a hardware token but have switched to a software token. Banks, meanwhile, were slow to adopt 2FA, and the best you seem to be able to hope for is SMS based authentication.

Credential Stuffing: The Dangers of Reusing Passwords Online

Watch on YouTube

A great explainer about account security that was apparently put out as an advertisement. You're not expected to buy anything, though. It seems someone struck on the idea of using the advertising facility at YouTube to expose people to security awareness training, which is actually quite brilliant.

Security questions - the darker the better

found on Memebase

On the one hand, security questions are generally not very good because the information they're asking for is actually public info that anyone could easily guess or look up in order to gain access to your account through the forgotten password mechanism. On the other hand, some of these topics are so uncomfortable the argument could be made that the answers actually aren't well known.

Maybe the best security questions would be the ones that probe our insecurities, because those are the things we're least likely to share.

Account security is getting overly aggressive

found on Izismile

I've never had someone try to fraudulently take over my account, but I have had to jump through extra hoops to prove I was the legitimate account holder of my own accounts, and in some cases I've even lost the account because I couldn't do enough to prove it. Sometimes having the password isn't good enough, and that just doesn't seem right.