> I think fundamentally most users don't understand anything more complicated than passwords. Passwords are easy. They make sense. A kindergartener understands

> I think fundamentally most users don't understand anything more complicated than passwords. Passwords are easy. They make sense. A kindergartener understands the idea of a secret word that only they know. I don't think it's that conceptually difficult to understand even for a layman. The bare minimum understanding of web security is that authentication is the process of proving who you are (your identity). You can do it one of three ways (or a combination of them): 1. "Something you know" - Password, Background questions, etc. 2. "Something you have" - Yubikey, Smartcard, TOTP, SMS, email, etc. 3. "Something you are" - Biometrics