>The rush to check that box has led to usability problems as well as security problems. Boroditsky points to Apple’s iCloud system, which came under fire after

>The rush to check that box has led to usability problems as well as security problems. Boroditsky points to Apple’s iCloud system, which came under fire after easily guessed account-recovery questions enabled the mass theft of nude photos in 2014. I'm still amazed by how many websites still use this "security question" mechanism. It's almost always the same questions too, "what's your mother's maiden name", "what's your childhood's pet name" etc... It's so easy to get the answers to these questions through the tiniest bit of social engineering, or even just exploring their facebook profiles. It's crazy how many websites manage to handle auth credentials incredibly poorly, it ought to be a solved problem by now. Last week I created an account on https://www.comedie-francaise.fr/ https://www.comedie-francaise.fr/, it used javascript to prevent me from pasting the password in the field (very convenient when you use a password manager, I had tweak the source to remove the limitation). Now that's pretty silly, but what's even sillier is that they then emailed me a password "reminder" in plaintext! So when so many websites can't seem to handle regular user+password login properly, it's not surprising that 2FA ends up being a huge mess.