> It is easy to blame a single person or a single company for poor practices, but I have yet to encounter any real solution to this problem that allows someone

> It is easy to blame a single person or a single company for poor practices, but I have yet to encounter any real solution to this problem that allows someone to prove they are who they say they are which is able to hit the sweet spot between too many false positives (hijacked accounts) and too many false negatives (valid customers locked out). We're getting there. Authentication comes down to three things, "Something you know (a password in your head), something you have (a private key, or a phone that gives you a code), and something you are (your face, a retinal scan, or a fingerprint)". In most cases, people won't lose what they are. There are of course exceptions, such as injuries by fire - which brings us right back to step one, hounding poor support agents with a (possibly fabricated) sob story. The weakest link is often the support folks who can press a button and allow the attacker to authenticate.