It seems that increasingly, companies are asking users to break the golden rules of security they once preached (or are breaking them for users). Once they wer

It seems that increasingly, companies are asking users to break the golden rules of security they once preached (or are breaking them for users). Once they were told to never under any circumstances share their password with anyone else. Now they're expected to tell whether it's OK to share their password with a third party website or not. To the non-technical user, they were doing something else, then were asked for their banking login. They weren't trying to log into the bank, so their vulnerability to phishing is slowly increased by this pattern. Similarly with "don't click links in emails you don't trust" - now we have security notification and email verification links to approve logins arriving, requiring users to click within 5 minutes to approve logins. Breaking the "don't fall for time pressure" rule too that users used to be trained with. Even their email client is most likely hiding the email address of the sender and focusing on the (self-declared) sender name, and some are now masking the destination of URLs when hovered over (Outlook protection), to make it near impossible for a user to tell what they're clicking. Back to banks, it definitely is a poor workflow and I share the same concern even where oauth style workflows are concerned - users likely can't tell if it's the real bank website or not, so they're being trained to divulge their credentials on demand. This will help attackers over time, as users become even more willing to share this kind of information upon request!